CVE-2022-50939

Katalog CVE

CVSS 7.2 · High EPSS 1,3%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada e107. Skor CVSS 3.1 7.2 (High) menurut vulncheck.com.

Deskripsi (NVD)

e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server files through path traversal. The vulnerability exists in the Media Manager's remote URL upload functionality (image.php) where the upload_caption parameter is not properly sanitized. An attacker with administrative privileges can use directory traversal sequences (../../../) in the upload_caption field to overwrite critical system files outside the intended upload directory. This can lead to complete compromise of the web application by overwriting configuration files, executable scripts, or other critical system components. The vulnerability was discovered by Hubert Wojciechowski and affects the image.php component in the admin interface.

Rincian

Terbit di NVD

13 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.exploit-db.com/exploits/50910 exploit · advisory pihak ketiga · vdb entry
• https://www.vulncheck.com/advisories/e-cms-upload-restriction-bypass-with-path-traversal-file-override advisory pihak ketiga
• https://e107.org/ product
• https://e107.org/download product