CVE-2025-11941
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
A vulnerability was detected in e107 CMS up to 2.3.3. It impacts an unknown function of the file /e107_admin/image.php?mode=main&action=avatar of the Avatar Handler component. Manipulation of the multiaction[] argument results in path traversal. The attack can be initiated remotely and the exploit is now public.
Risk Assessment
An attacker can remotely read or write files outside the intended directory, potentially leading to data disclosure or system compromise. The vendor did not respond to the disclosure, so a fix may not be available.
Recommendation
Restrict access to the e107 admin panel and consider WAF rules blocking manipulation of the multiaction[] parameter. Monitor the vendor for an official fix.
Other vulnerabilities in e107 CMS
See all- CVE-2022-50939High
Critical vulnerability in e107 CMS version 3.2.1 allows authenticated administrators to overwrite arbitrary server files via path traversal in the Media Manager's remote URL upload functionality (image.php). The upload_caption parameter is not properly sanitized, enabling directory traversal sequences like ../../../ to overwrite files outside the intended directory. This can lead to complete compromise of the web application.
- CVE-2022-50916High
CVE-2022-50916 affects e107 CMS version 3.2.1. The vulnerability is a file upload flaw in the Media Manager import functionality that allows authenticated administrators to overwrite server files, such as top.php in the web application directory.
- CVE-2022-50907High
CVE-2022-50907 affects e107 CMS version 3.2.1. The vulnerability allows authenticated administrative users to bypass upload restrictions and execute PHP files by manipulating the upload URL parameter in the Media Manager import feature. This enables remote code execution on the server.
- CVE-2022-50905Critical
e107 CMS version 3.2.1 contains multiple vulnerabilities allowing XSS attacks. The first is a reflected XSS in the news comment functionality, where an authenticated user can inject malicious JavaScript via a URL parameter. The second is an upload restriction bypass for admins, allowing SVG files with malicious code to be uploaded via the media manager's remote URL feature, leading to stored XSS.
- CVE-2026-48997High
e107 is a content management system (CMS), versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In the resize_image() function, the source path is properly escaped, but the destination path is inserted inside raw double quotes, allowing an attacker to inject malicious code.
- CVE-2026-46620Medium
CSRF vulnerability in e107 CMS before version 2.3.5. The CSRF token validation is skipped if no token is present in the request.
- CVE-2021-47937High
e107 CMS 2.3.0 allows authenticated users with theme installation permissions to execute arbitrary code by uploading a malicious theme file. Attackers can upload a crafted theme package via the theme.php endpoint that deploys a web shell to the e107_themes directory, then execute system commands via the payload.php script.
Original NVD description (English source)
A vulnerability was detected in e107 CMS up to 2.3.3. This impacts an unknown function of the file /e107_admin/image.php?mode=main&action=avatar of the component Avatar Handler. Performing manipulation of the argument multiaction[] results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS