CVE-2022-50907

High · 7.2

CVSS

7.2

EPSS

1.2%

Published

Jan 13, 2026

CISA due date

—

The record

e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files. Attackers can upload malicious PHP files to parent directories by manipulating the upload URL parameter, enabling remote code execution through the Media Manager import feature.

Affected packages

Ecosystem	Package	Introduced	Fixed