CVE-2022-50916: e107 CMS v3.2.1 - Upload restriction bypass (Authenticated [Admin])+ Server file override

Published Jan 13, 2026

Updated

e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrators to override server files through the Media Manager import functionality. Attackers can exploit the upload mechanism by manipulating the upload URL parameter to overwrite existing files like top.php in the web application directory.

Affected Software

2 affected components

e107 E107 Cms

e107 e107=3.2.1

Event History

Jan 13, 2026

CVE Published

via MITRE·10:51 PM

Data Sourced

via MITRE·10:51 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2022-50916?

CVE-2022-50916 is classified as a high severity vulnerability due to its potential for authenticated file upload and server file override by administrators.

How do I fix CVE-2022-50916?

To fix CVE-2022-50916, it is recommended to update to the latest version of e107 CMS that addresses this vulnerability.

Who is affected by CVE-2022-50916?

CVE-2022-50916 affects authenticated administrators of e107 CMS version 3.2.1.

What type of vulnerability is CVE-2022-50916?

CVE-2022-50916 is a file upload vulnerability that allows for server file overrides.

Can CVE-2022-50916 be exploited remotely?

CVE-2022-50916 requires authenticated access, meaning it cannot be exploited remotely without valid admin credentials.