CVE-2022-50907: e107 CMS File Upload RCE Vulnerability

CVE-2022-50907 Overview

CVE-2022-50907 is a file upload vulnerability affecting e107 CMS version 3.2.1 that allows authenticated administrative users to bypass upload restrictions and execute arbitrary PHP files. The vulnerability exists in the Media Manager import feature, where attackers can manipulate the upload URL parameter to upload malicious PHP files to parent directories, ultimately enabling remote code execution on the target system.

Critical Impact

Authenticated attackers with administrative privileges can achieve full remote code execution by uploading and executing malicious PHP files, potentially leading to complete server compromise.

Affected Products

• e107 CMS version 3.2.1

Discovery Timeline

• 2026-01-13 - CVE CVE-2022-50907 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2022-50907

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The e107 CMS Media Manager feature contains insufficient validation of file upload destinations, allowing administrative users to bypass intended restrictions on where files can be uploaded and what types of files are permitted.

The attack leverages the import functionality within Media Manager, where the upload URL parameter can be manipulated to target parent directories outside the intended upload location. By crafting malicious requests, an attacker can upload PHP files that would normally be restricted, placing them in web-accessible directories where they can be subsequently executed.

While the vulnerability requires administrative authentication (high privileges), the network-accessible attack vector combined with the potential for complete system compromise through remote code execution makes this a serious security concern for e107 CMS deployments.

Root Cause

The root cause of this vulnerability lies in improper input validation and insufficient path sanitization within the Media Manager's file upload handling logic. The application fails to adequately validate and restrict the destination path for uploaded files, allowing directory traversal sequences in the upload URL parameter to escape the intended upload directory. Additionally, file type restrictions are not properly enforced, permitting PHP files to be uploaded despite intended security controls.

Attack Vector

The attack is carried out over the network by an authenticated administrative user. The attacker authenticates to the e107 CMS administrative panel and navigates to the Media Manager import feature. By manipulating the URL parameter used during the import process, the attacker can specify a path that traverses to parent directories. This allows uploading a malicious PHP file (such as a web shell) to a location accessible via the web server. Once uploaded, the attacker can access the PHP file through a direct HTTP request, triggering code execution with the privileges of the web server process.

The vulnerability mechanism involves path traversal combined with unrestricted file upload. Detailed technical information and proof-of-concept details can be found in the Exploit-DB #50910 entry and the VulnCheck Advisory.

Detection Methods for CVE-2022-50907

Indicators of Compromise

• Unexpected PHP files appearing in web-accessible directories outside the standard e107 upload locations
• Web server access logs showing requests to unusual PHP files, particularly those with shell-like functionality
• HTTP POST requests to the Media Manager import endpoint containing path traversal sequences (e.g., ../)
• New or modified files in the e107 installation root or parent directories with recent timestamps

Detection Strategies

• Monitor file system changes in the e107 CMS installation directory for unexpected PHP file creation
• Implement web application firewall (WAF) rules to detect path traversal attempts in upload parameters
• Review administrative authentication logs for suspicious login activity preceding file upload operations
• Configure intrusion detection systems to alert on web shell signatures and common PHP backdoor patterns

Monitoring Recommendations

• Enable comprehensive logging for the e107 CMS administrative panel, particularly for Media Manager operations
• Implement file integrity monitoring (FIM) on the web server document root to detect unauthorized file modifications
• Set up alerts for PHP file creation events outside designated upload directories
• Regularly audit administrative user accounts and their activity within the CMS

How to Mitigate CVE-2022-50907

Immediate Actions Required

• Restrict administrative access to the e107 CMS to only trusted users with legitimate business needs
• Implement additional authentication controls such as IP whitelisting for administrative functions
• Review recent file uploads and administrative activity for signs of exploitation
• Consider temporarily disabling the Media Manager import feature until a patch is available

Patch Information

Users should check the e107 Official Site and e107 Download Page for the latest version releases and security updates. It is recommended to upgrade to the most recent version of e107 CMS that addresses this vulnerability. Review the VulnCheck Advisory for additional guidance on remediation.

Workarounds

• Implement strict input validation on the web server or reverse proxy to block path traversal sequences in upload requests
• Configure the web server to deny execution of PHP files in upload directories using .htaccess rules or equivalent configurations
• Apply the principle of least privilege by limiting administrative account access to only essential personnel
• Use web application firewall rules to filter requests containing suspicious path manipulation patterns

# Example Apache .htaccess configuration to prevent PHP execution in upload directories
# Place this file in the e107 upload directories

# Disable PHP execution
<FilesMatch "\.php$">
    SetHandler none
    SetHandler default-handler
    Options -ExecCGI
    RemoveHandler .php
</FilesMatch>

# Deny direct access to PHP files
<Files "*.php">
    Order Deny,Allow
    Deny from all
</Files>