Vulnerability · Published Jan 13, 2026 · Assigned by VulnCheck
CVE-2022-50898NanoCMS 0.4 - Remote Code Execution (RCE) (Authenticated)
High 8.8
In plain English
A high-severity unrestricted file upload in NanoCMS from kalyan02. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.3%top 29.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
NanoCMS 0.4 contains an authenticated file upload vulnerability that allows remote code execution through unvalidated page content creation. Authenticated attackers can upload PHP files with arbitrary code to the server's pages directory by exploiting the page creation mechanism without proper input sanitization.
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-50997 exploit
- NanoCMS GitHub Repository product
- NanoCMS Exploit Archive exploit
- VulnCheck Advisory: NanoCMS 0.4 - Remote Code Execution (RCE) (Authenticated) third-party-advisory