CVE-2022-50907 HIGH

CVE-2022-50907: e107 CMS v3.2.1 - Admin Upload Restriction Bypass + RCE

Vendor E107

Product e107 CMS

Weakness CWE-434 · Unrestricted file upload

Published January 13, 2026

Last update April 7, 2026

View on NVD All CVEs

CVSS base score

8.6/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files. Attackers can upload malicious PHP files to parent directories by manipulating the upload URL parameter, enabling remote code execution through the Media Manager import feature.

Key dates

02Disclosure timeline

January 13, 2026 CVE published

April 7, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-50907 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2025-15426 jackying H-ui.admin preview.php unrestricted upload CVE-2023-3797 Gen Technology Four Mountain Torrent Disaster Prevention and Control of Monitoring and Early Warning System UploadFloodPlanFileUpdate.ashx unrestricted upload CVE-2025-9476 SourceCodester Human Resource Information System editemployee_process.php unrestricted upload CVE-2021-35963 Learningdigital.com, Inc. Orca HCM - Unrestricted Upload of File with Dangerous Type CVE-2025-67924 WordPress Corpkit theme <= 2.0 - Arbitrary File Upload vulnerability