Medium severity · published Jan 13, 2026
CVE-2022-50906
e107 CMS v3.2.1 - Admin Upload Restriction Bypass + Stored XSS
4.8
CVSS
0.4%
EPSS
No
On KEV
Description
e107 CMS 3.2.1 contains an upload restriction bypass vulnerability that allows authenticated administrators to upload malicious SVG files through the media manager. Attackers with admin privileges can exploit this vulnerability to upload SVG files with embedded cross-site scripting (XSS) payloads that can execute arbitrary scripts when viewed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
e107 CMS · e107
3.2.1 · source: vendor
E1
E107 · E107
3.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-50906
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-50906
Product
https://e107.org/
Product
https://e107.org/download
Exploit
https://www.exploit-db.com/exploits/50910
Third Party Advisory
https://www.vulncheck.com/advisories/e-cms-admin-upload-restriction-bypass-stored-xss
More from e107 CMS
8.8
CVE-2021-47937
e107 CMS 2.3.0 Authenticated Remote Code Execution via Theme Upload
7.2
CVE-2022-50939
e107 CMS v3.2.1 - Upload Restriction Bypass with Path Traversal File Override
7.2
CVE-2022-50916
e107 CMS v3.2.1 - Upload restriction bypass (Authenticated [Admin])+ Server file override
7.2
CVE-2022-50907
e107 CMS v3.2.1 - Admin Upload Restriction Bypass + RCE
6.1
CVE-2022-50905
e107 CMS v3.2.1 - Reflected XSS via Comment Flow