CVE-2022-50916 HIGH

CVE-2022-50916: e107 CMS v3.2.1 - Upload restriction bypass (Authenticated [Admin])+ Server file override

Vendor E107
Product e107 CMS
Weakness CWE-434 · Unrestricted file upload
Published January 13, 2026
Last update April 7, 2026
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrators to override server files through the Media Manager import functionality. Attackers can exploit the upload mechanism by manipulating the upload URL parameter to overwrite existing files like top.php in the web application directory.

Key dates

02Disclosure timeline

January 13, 2026 CVE published
April 7, 2026 Record updated