Cyber Resilience

CVE-2022-50916

HighPublic PoC

Published: 13 January 2026

Published
13 January 2026
Modified
16 January 2026
KEV Added
Patch
CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0080 52.0th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2022-50916 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in E107 E107. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-5 (Access Restrictions for Change) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2022-50916 is a file upload vulnerability in e107 CMS version 3.2.1, specifically within the Media Manager import functionality. It enables authenticated administrators to override existing server files, such as top.php in the web application directory, by manipulating the upload URL parameter. The issue is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts.

The vulnerability can be exploited by authenticated administrators with network access, requiring low attack complexity and no user interaction. By crafting a malicious upload request and altering the URL parameter, an attacker can overwrite critical files on the server, potentially granting them the ability to execute arbitrary code, modify application behavior, or achieve full server compromise.

Advisories and related resources include the official e107.org site, its download page for potential updates, an Exploit-DB entry at https://www.exploit-db.com/exploits/50910 detailing the exploit, and a Vulncheck advisory at https://www.vulncheck.com/advisories/e-cms-upload-restriction-bypass-authenticated-admin-server-file-override, which security practitioners should consult for mitigation steps and patch availability.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrators to override server files through the Media Manager import functionality. Attackers can exploit the upload mechanism by manipulating the upload URL parameter to overwrite existing files like…

more

top.php in the web application directory.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
Why these techniques?

File upload vuln in public-facing CMS enables direct web shell deployment via file overwrite for code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2022-50907Same product: E107 E107
CVE-2022-50939Same product: E107 E107
CVE-2025-11941Same product: E107 E107
CVE-2022-50905Same product: E107 E107
CVE-2025-22654Shared CWE-434
CVE-2025-11948Shared CWE-434
CVE-2025-67260Shared CWE-434
CVE-2025-28915Shared CWE-434
CVE-2023-53956Shared CWE-434
CVE-2025-6058Shared CWE-434

Affected Assets

e107
e107
3.2.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Enforces validation of file type, path, and destination parameters in the Media Manager upload to block URL manipulation that overwrites files such as top.php.

prevent

Restricts the ability of even authenticated administrators to perform arbitrary file overwrites through the import functionality.

preventdetect

Scans or filters uploaded content before it is written to the web root, mitigating the unrestricted upload of dangerous file types.

References