CVE-2022-50907: e107 CMS v3.2.1 - Admin Upload Restriction Bypass + RCE
e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files. Attackers can upload malicious PHP files to parent directories by manipulating the upload URL parameter, enabling remote code execution through the Media Manager import feature.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50907?
CVE-2022-50907 is rated as a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2022-50907?
To fix CVE-2022-50907, update to e107 CMS version 3.2.2 or later, which includes a patch for this vulnerability.
Who is affected by CVE-2022-50907?
Authenticated administrative users of e107 CMS version 3.2.1 are primarily affected by CVE-2022-50907.
What type of attack does CVE-2022-50907 enable?
CVE-2022-50907 enables attackers to bypass file upload restrictions and execute arbitrary PHP code on the server.
Can CVE-2022-50907 lead to a full system compromise?
Yes, CVE-2022-50907 can lead to a full system compromise since it allows attackers to execute arbitrary code on the server.