High severity · published Jan 13, 2026
CVE-2022-50907
e107 CMS v3.2.1 - Admin Upload Restriction Bypass + RCE
7.2
CVSS
1.2%
EPSS
No
On KEV
Description
e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files. Attackers can upload malicious PHP files to parent directories by manipulating the upload URL parameter, enabling remote code execution through the Media Manager import feature.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
e107 CMS · e107
3.2.1 · source: vendor
E1
E107 · E107
3.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-50907
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-50907
Product
https://e107.org/
Product
https://e107.org/download
Exploit
https://www.exploit-db.com/exploits/50910
Third Party Advisory
https://www.vulncheck.com/advisories/e-cms-admin-upload-restriction-bypass-rce
More from e107 CMS
8.8
CVE-2021-47937
e107 CMS 2.3.0 Authenticated Remote Code Execution via Theme Upload
7.2
CVE-2022-50939
e107 CMS v3.2.1 - Upload Restriction Bypass with Path Traversal File Override
7.2
CVE-2022-50916
e107 CMS v3.2.1 - Upload restriction bypass (Authenticated [Admin])+ Server file override
6.1
CVE-2022-50905
e107 CMS v3.2.1 - Reflected XSS via Comment Flow
5.4
CVE-2023-43874
Multiple Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Copyright and Author fields in…