Vulnerability · Published Jan 13, 2026 · Assigned by VulnCheck
CVE-2022-50916e107 CMS v3.2.1 - Upload restriction bypass (Authenticated [Admin])+ Server file override
High 7.2
In plain English
A high-severity unrestricted file upload in e107 CMS from e107. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.0%top 38.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrators to override server files through the Media Manager import functionality. Attackers can exploit the upload mechanism by manipulating the upload URL parameter to overwrite existing files like top.php in the web application directory.
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-50910 exploit
- Official Vendor Homepage product
- Software Download Page product
- VulnCheck Advisory: e107 CMS v3.2.1 - Upload restriction bypass (Authenticated [Admin])+ Server file override third-party-advisory