← Back to CVEs

CVE-2022-50912

CRITICAL

9.8

Description

ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload potentially malicious files. Attackers can bypass file upload restrictions by using alternative file extensions .php2.php6.php7.phps.pht to execute arbitrary PHP code on the server.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published1/13/2026

Last Modified2/3/2026

Sourcenvd

Honeypot Sightings0

Affected Products

impresscms:impresscms

Weaknesses (CWE)

CWE-434

References

https://github.com/ImpressCMS/impresscms(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/50890(disclosure@vulncheck.com)

https://www.impresscms.org/(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/impresscms-unrestricted-file-upload(disclosure@vulncheck.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.