CVE-2022-50912

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload potentially malicious files. Attackers can bypass file upload restrictions by using alternative file extensions .php2.php6.php7.phps.pht to execute arbitrary PHP code on the server.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
ImpressCMSImpressCMS1.4.4

References

Timeline

Published
Jan 13, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-509138.4ITeC ITeCProteccioAppServer contains an unquoted service path vulnerability that allows local attackers to execute code with elevated systemCVE-2022-509148.4EaseUS Data Recovery 15.1.0.0 contains an unquoted service path vulnerability in the EaseUS UPDATE SERVICE executable. Attackers can exploitCVE-2022-509157.8PTPublisher 2.3.4 contains an unquoted service path vulnerability in the PTProtect service that allows local attackers to potentially executCVE-2022-509167.2e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrators to override server files through the MeCVE-2022-509177.8ProtonVPN 1.26.0 contains an unquoted service path vulnerability in its WireGuard service configuration that allows local attackers to potenCVE-2022-509188.4VIVE Runtime Service 1.0.0.4 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevatedCVE-2022-509199.8Tdarr 2.00.15 contains an unauthenticated remote code execution vulnerability in its Help terminal that allows attackers to inject and chainCVE-2022-509208.4Sandboxie-Plus 5.50.2 contains an unquoted service path vulnerability in the SbieSvc Windows service that allows local attackers to potentiaCVE-2022-509217.8WOW21 5.0.1.9 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevateCVE-2022-509229.8Audio Conversion Wizard v2.01 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting memoryCVE-2022-509237.8Cobian Backup 0.9 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated system priCVE-2022-509248.4Private Internet Access 3.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code wi
CVE-2022-50912: Critical severity, CVSS 9.8 | Vulnix