{"id":"CVE-2022-50912","state":"PUBLISHED","title":"ImpressCMS 1.4.4 - Unrestricted File Upload","description":"ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload potentially malicious files. Attackers can bypass file upload restrictions by using alternative file extensions .php2.php6.php7.phps.pht to execute arbitrary PHP code on the server.","publishedAt":"2026-01-13T22:51:51.296Z","updatedAt":"2026-03-05T01:29:30.264Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["ImpressCMS ImpressCMS"],"affected":[{"vendor":"ImpressCMS","product":"ImpressCMS","versions":[{"version":"1.4.4","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/50890","https://www.impresscms.org/","https://github.com/ImpressCMS/impresscms","https://www.vulncheck.com/advisories/impresscms-unrestricted-file-upload"],"weaknesses":["CWE-434"],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/50xxx/CVE-2022-50912.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50912","state":"PUBLISHED","datePublished":"2026-01-13T22:51:51.296Z","dateUpdated":"2026-03-05T01:29:30.264Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-01-11T13:14:18.876Z"},"containers":{"cna":{"title":"ImpressCMS 1.4.4 - Unrestricted File Upload","descriptions":[{"lang":"en","value":"ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload potentially malicious files. Attackers can bypass file upload restrictions by using alternative file extensions .php2.php6.php7.phps.pht to execute arbitrary PHP code on the server."}],"affected":[{"vendor":"ImpressCMS","product":"ImpressCMS","versions":[{"version":"1.4.4","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/50890","name":"ExploitDB-50890","tags":["exploit"]},{"url":"https://www.impresscms.org/","name":"Official ImpressCMS Homepage","tags":["product"]},{"url":"https://github.com/ImpressCMS/impresscms","name":"ImpressCMS GitHub Repository","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/impresscms-unrestricted-file-upload","name":"VulnCheck Advisory: ImpressCMS 1.4.4 - Unrestricted File Upload","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","lang":"en","description":"Unrestricted Upload of File with Dangerous Type","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-03-05T01:29:30.264Z"},"datePublic":"2022-07-04T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:impresscms:impresscms:1.4.4:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"Ünsal Furkan Harani (Zemarkhos)","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-14T16:14:57.832830Z","id":"CVE-2022-50912","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-14T16:15:05.429Z"}}]}}}