CVE-2022-50912

critical · 9.3

ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload potentially malicious files. Attackers can bypass file upload restrictions by using alternative file extensions .php2.php6.php7.phps.pht to execute arbitrary PHP code on the server.

9.3

CVSS

1.1%

EPSS (exploit prob.)

65th

EPSS percentile

2026-01-13

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-434

Affected products

Vendor	Product	Affected versions
impresscms	impresscms	1.4.4

Check a specific version with /api/v1/cve/match.

References

https://github.com/ImpressCMS/impresscms
https://www.exploit-db.com/exploits/50890
https://www.impresscms.org/
https://www.vulncheck.com/advisories/impresscms-unrestricted-file-upload

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-50912