Vulnerability Report

CVE-2022-50906

Title: Upload Restriction Bypass to XSS in e107 CMS

XSS

Proof Of Concept

No public PoC currently indexed for CVE-2022-50906.

CWE Category CWE-79

Published Date Jan 13, 2026

Modified Date Jan 16, 2026

Exploit Status Not Found

Score 4.8 CVSS v4.0

Exploit Probability (EPSS)

0.35%

Vulnerability Summary

CVE-2022-50906: e107 CMS 3.2.1 contains an upload restriction bypass vulnerability that allows authenticated administrators to upload malicious SVG files through the media manager. Attackers with admin privileges can exploit this vulnerability to upload SVG files with embedded cross-site scripting (XSS) payloads that can execute arbitrary scripts when viewed.

Impacted Vendors

e107 1

Reference Links

https://e107.org/ https://e107.org/download https://www.exploit-db.com/exploits/50910 https://www.vulncheck.com/advisories/e-cms-admin-upload-restriction-bypass-stored-xss

CVSS v4.0

Source Entity [email protected]

Severity MEDIUM

4.8

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

PASSIVE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

N/A

RAW VECTOR

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

4.8

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

4.8

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns