Back to overview

CVE-2022-50912

CRITICAL Exploitation: PoC
9.8
CVSS 3.1
Description
ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload potentially malicious files. Attackers can bypass file upload restrictions by using alternative file extensions .php2.php6.php7.phps.pht to execute arbitrary PHP code on the server.

Metadata

CVE ID
CVE-2022-50912
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-01-11 13:14 UTC
Published
2026-01-13 22:51 UTC
Last updated
2026-03-05 01:29 UTC
Primary CWE
CWE-434
Unrestricted Upload of File with Dangerous Type
Vendor / Product
ImpressCMS / ImpressCMS
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
ImpressCMS ImpressCMS — 1.4.4
Weakness (CWE)
CWESourceDescription
CWE-434 cna Unrestricted Upload of File with Dangerous Type
CVSS scores (2)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References (4)
Back to overview