CVE-2025-11941: e107 CMS Avatar image.php path traversal
A vulnerability was detected in e107 CMS up to 2.3.3. This impacts an unknown function of the file /e107admin/image.php?mode=main&action=avatar of the component Avatar Handler. Performing manipulation of the argument multiaction[] results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11941?
CVE-2025-11941 is rated as a moderate severity vulnerability affecting e107 CMS up to version 2.3.3.
How do I fix CVE-2025-11941?
To fix CVE-2025-11941, update e107 CMS to the latest version beyond 2.3.3.
What type of vulnerability is CVE-2025-11941?
CVE-2025-11941 is a path traversal vulnerability found in the Avatar Handler component of e107 CMS.
What component is affected by CVE-2025-11941?
CVE-2025-11941 affects the Avatar Handler component in e107 CMS.
Who is affected by CVE-2025-11941?
Any users of e107 CMS versions up to and including 2.3.3 are susceptible to CVE-2025-11941.