Vulnerability · Published Jan 13, 2026 · Assigned by VulnCheck
CVE-2022-50907e107 CMS v3.2.1 - Admin Upload Restriction Bypass + RCE
High 7.2
In plain English
A high-severity unrestricted file upload in e107 CMS from e107. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.2%top 30.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files. Attackers can upload malicious PHP files to parent directories by manipulating the upload URL parameter, enabling remote code execution through the Media Manager import feature.
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-50910 exploit
- Official e107 CMS Vendor Homepage product
- e107 CMS Download Page product
- VulnCheck Advisory: e107 CMS v3.2.1 - Admin Upload Restriction Bypass + RCE third-party-advisory