CVE-2022-50939
CVE-2022-50939 is a high-severity vulnerability in E107 with a CVSS 3.x base score of 7.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-22.
Key facts
- Severity: High (CVSS 3.x base score 7.2)
- CVSS v4: 8.6
- EPSS exploit prediction: 1% (70th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-2600
- Weakness: CWE-22
- Affected product: E107
- Published:
- Last modified:
Description
e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server files through path traversal. The vulnerability exists in the Media Manager's remote URL upload functionality (image.php) where the upload_caption parameter is not properly sanitized. An attacker with administrative privileges can use directory traversal sequences (../../../) in the upload_caption field to overwrite critical system files outside the intended upload directory. This can lead to complete compromise of the web application by overwriting configuration files, executable scripts, or other critical system components. The vulnerability was discovered by Hubert Wojciechowski and affects the image.php component in the admin interface.
Frequently asked questions
- What is CVE-2022-50939?
- e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server files through path traversal. The vulnerability exists in the Media Manager's remote URL upload functionality (image.php) where the upload_caption parameter is not properly sanitized. An attacker with administrative privileges can use directory traversal sequences (../../../) in the upload_caption field to overwrite critical system files outside the intended upload directory. This can lead to complete compromise of the web application by overwriting configuration files, executable scripts, or other critical system components. The vulnerability was discovered by Hubert Wojciechowski and affects the image.php component in the admin interface.
- How severe is CVE-2022-50939?
- CVE-2022-50939 has a CVSS 3.x base score of 7.2, rated high severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2022-50939 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (70th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2022-50939?
- CVE-2022-50939 affects E107. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2022-50939?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2022-50939 have an EU (EUVD) identifier?
- Yes. CVE-2022-50939 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-2600.
- When was CVE-2022-50939 published?
- CVE-2022-50939 was published on 2026-01-13 and last updated on 2026-06-17.
References
- https://e107.org/
- https://e107.org/download
- https://www.exploit-db.com/exploits/50910
- https://www.vulncheck.com/advisories/e-cms-upload-restriction-bypass-with-path-traversal-file-override
Affected products (1)
- cpe:2.3:a:e107:e107:3.2.1:*:*:*:*:*:*:*
More vulnerabilities in E107
- CVE-2008-1989 — Critical (CVSS 10.0): PHP remote file inclusion vulnerability in 123flashchat.php in the 123 Flash Chat 6.8.0 module for e107, when…
- CVE-2022-50905 — Critical (CVSS 9.8): e107 CMS version 3.2.1 contains multiple vulnerabilities that allow cross-site scripting (XSS) attacks. The first…
- CVE-2021-27885 — High (CVSS 8.8): usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism.
- CVE-2016-10753 — High (CVSS 8.8): e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without…
- CVE-2018-15901 — High (CVSS 8.8): e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including…
- CVE-2011-1513 — High (CVSS 7.5): Static code injection vulnerability in install_.php in e107 CMS 0.7.24 and probably earlier versions, when the…
Other CWE-22 (Path Traversal) vulnerabilities
- CVE-2026-55393 — Critical (CVSS 10.0): Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9…
- CVE-2026-80155 — Critical (CVSS 10.0): Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1,…
- CVE-2026-70200 — Critical (CVSS 10.0): Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an…
- CVE-2026-85706 — Critical (CVSS 10.0): GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9,…
- CVE-2026-76606 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2.
- CVE-2026-18051 — Critical (CVSS 10.0): The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache…