CVE-2022-50907
File Upload Vulnerability in e107 CMS 3.2.1 Enables RCE
Publication date: 2026-01-13
Last updated on: 2026-01-13
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| e107 | e107 | 3.2.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2022-50907 is a file upload vulnerability in e107 CMS version 3.2.1 that allows authenticated administrative users to bypass upload restrictions by manipulating the upload URL parameter. This enables them to upload malicious PHP files to parent directories via the Media Manager import feature, leading to remote code execution on the server. [2]
How can this vulnerability impact me? :
This vulnerability can lead to remote code execution on the server, allowing an attacker with administrative access to execute arbitrary PHP code. This can result in full server compromise, including the ability to run system commands, overwrite critical files, and maintain persistent control over the application and server. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve checking for unauthorized PHP files uploaded outside the default upload directories, especially in parent directories. Since the vulnerability allows authenticated admin users to upload PHP files via manipulated upload URL parameters, monitoring web server directories for unexpected PHP files (e.g., using commands like 'find /path/to/webroot -name "*.php" -mtime -7' to find recently added PHP files) can help. Additionally, reviewing web server logs for suspicious POST requests to the Media Manager import feature with directory traversal patterns (e.g., '../../../') in upload parameters can indicate exploitation attempts. However, no specific commands are provided in the resources. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting administrative user access to trusted personnel only, as exploitation requires authenticated admin privileges. Applying patches or updates from the e107 CMS vendor once available is critical. Until a patch is applied, disabling or restricting the Media Manager import feature or file upload functionality for administrators can reduce risk. Monitoring and removing any suspicious PHP files uploaded outside the intended directories is also recommended. Implementing strict input validation and upload restrictions to prevent directory traversal in upload parameters is necessary once fixes are deployed. [2]