Vulnerability · Published Jan 13, 2026 · Assigned by VulnCheck

CVE-2022-50939e107 CMS v3.2.1 - Upload Restriction Bypass with Path Traversal File Override

High 7.2

In plain English

A high-severity path traversal in e107 CMS from E107. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)1.3%top 29.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server files through path traversal. The vulnerability exists in the Media Manager's remote URL upload functionality (image.php) where the upload_caption parameter is not properly sanitized. An attacker with administrative privileges can use directory traversal sequences (../../../) in the upload_caption field to overwrite critical system files outside the intended upload directory. This can lead to complete compromise of the web application by overwriting configuration files, executable scripts, or other critical system components. The vulnerability was discovered by Hubert Wojciechowski and affects the image.php component in the admin interface.

Affected products (as reported)

Vendor	Product	Versions
E107	e107 CMS	3.2.1

Weakness: CWE-22, CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

ExploitDB-50910 exploit
Official Vendor Homepage product
Software Download Page product
VulnCheck Advisory: e107 CMS v3.2.1 - Upload Restriction Bypass with Path Traversal File Override third-party-advisory