CVE-2022-50906

e107 CMS v3.2.1 - Admin Upload Restriction Bypass + Stored XSS

Medium4.8Public exploitEPSS 0.43%

Published: 13 Jan 2026
Updated: 7 Apr 2026
Reserved: 11 Jan 2026
Assigned by: VulnCheck

Description

e107 CMS 3.2.1 contains an upload restriction bypass vulnerability that allows authenticated administrators to upload malicious SVG files through the media manager. Attackers with admin privileges can exploit this vulnerability to upload SVG files with embedded cross-site scripting (XSS) payloads that can execute arbitrary scripts when viewed.

Public exploit

A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.

ExploitDB-50910 (opens in a new tab)exploit

Timeline

2026
11 Jan 2026
11 Jan 2026
ID reserved
By VulnCheck
13 Jan 20262 days later
13 Jan 2026· 2 days later
Published
7 Apr 20263 months later
7 Apr 2026· 3 months later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2022-50906, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Medium4.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
VulnCheckCNA (assigner)	3.1	Medium4.8	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
NVDNVD · Modified	4.0	Medium4.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.43% · top 63% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.8.

Weakness

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

e107 · e107 CMS
- affected 3.2.1

References (4)

ExploitDB-50910 (opens in a new tab)exploit
Official Vendor Homepage (opens in a new tab)product
Software Download Page (opens in a new tab)product
VulnCheck Advisory: e107 CMS v3.2.1 - Admin Upload Restriction Bypass + Stored XSS (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-50906](https://trackcve.app/badge/CVE-2022-50906.svg)](https://trackcve.app/cve/CVE-2022-50906)

Record last updated 7 Apr 2026, 14:06 UTC.