CVE-2022-50912

CRITICAL

ImpressCMS 1.4.4 - Code Injection

Title source: llm

Description

ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload potentially malicious files. Attackers can bypass file upload restrictions by using alternative file extensions .php2.php6.php7.phps.pht to execute arbitrary PHP code on the server.

Exploits (1)

exploitdb WRITEUP
by Ünsal Furkan Harani · textwebappsphp
https://www.exploit-db.com/exploits/50890

References (4)

Scores

CVSS v3 9.8
EPSS 0.0020
EPSS Percentile 41.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-434
Status published
Products (1)
impresscms/impresscms 1.4.4
Published Jan 13, 2026
Tracked Since Feb 18, 2026