CVE-2022-50907
Published: 13 January 2026
Summary
CVE-2022-50907 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in E107 E107. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 40.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2022-50907 is a file upload vulnerability in e107 CMS version 3.2.1 that enables authenticated administrative users to bypass upload restrictions and execute arbitrary PHP files. By manipulating the upload URL parameter in the Media Manager import feature, attackers can place malicious PHP files into parent directories, resulting in remote code execution. The issue is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
The vulnerability requires administrative privileges (PR:H) but can be exploited remotely (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). An authenticated admin can upload and execute malicious PHP code, achieving full remote code execution on the server with high impacts to confidentiality, integrity, and availability.
Advisories and resources include the official e107.org site and its download page for updates, an Exploit-DB entry (exploits/50910) with a proof-of-concept, and a VulnCheck advisory detailing the e-Cms admin upload restriction bypass leading to RCE. Security practitioners should consult these for patch availability and mitigation guidance.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2599
Vulnerability details
e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files. Attackers can upload malicious PHP files to parent directories by manipulating the upload URL parameter, enabling remote code…
more
execution through the Media Manager import feature.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload in public-facing CMS enables RCE via malicious PHP web shell upload.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation of file types, names, and path parameters during upload to block dangerous PHP files and directory traversal in the Media Manager.
Enforces the intended upload authorization policy that the vulnerability bypasses, preventing placement of executable files outside allowed directories.
Scans or filters uploaded content for malicious code (e.g., PHP webshells) before execution is possible, mitigating the RCE outcome of the CWE-434 flaw.