CVE-2022-50916

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrators to override server files through the Media Manager import functionality. Attackers can exploit the upload mechanism by manipulating the upload URL parameter to overwrite existing files like top.php in the web application directory.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
e107	e107 CMS	3.2.1

References

https://e107.org/Product
https://e107.org/downloadProduct
https://www.exploit-db.com/exploits/50910Exploit, Third Party Advisory, VDB Entry
https://www.vulncheck.com/advisories/e-cms-upload-restriction-bypass-authenticated-admin-server-file-overrideThird Party Advisory

Timeline

Published: Jan 13, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-509177.8ProtonVPN 1.26.0 contains an unquoted service path vulnerability in its WireGuard service configuration that allows local attackers to poten CVE-2022-509188.4VIVE Runtime Service 1.0.0.4 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated CVE-2022-509199.8Tdarr 2.00.15 contains an unauthenticated remote code execution vulnerability in its Help terminal that allows attackers to inject and chain CVE-2022-509208.4Sandboxie-Plus 5.50.2 contains an unquoted service path vulnerability in the SbieSvc Windows service that allows local attackers to potentia CVE-2022-509217.8WOW21 5.0.1.9 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevate CVE-2022-509229.8Audio Conversion Wizard v2.01 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting memory CVE-2022-509237.8Cobian Backup 0.9 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated system pri CVE-2022-509248.4Private Internet Access 3.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code wi CVE-2022-509259.8Prowise Reflect version 1.0.9 contains a remote keystroke injection vulnerability that allows attackers to send keyboard events through an e CVE-2022-509269.8WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability that allows attackers to manipulate user session cook CVE-2022-509276.2Cyclades Serial Console Server 3.3.0 contains a local privilege escalation vulnerability due to overly permissive sudo privileges for the ad CVE-2022-509287.8BlueSoleilCS 5.4.277 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to pot