Critical severity9.8OSV Advisory· Published Jan 13, 2026· Updated Jun 17, 2026
CVE-2022-50912
CVE-2022-50912
Description
ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload potentially malicious files. Attackers can bypass file upload restrictions by using alternative file extensions .php2.php6.php7.phps.pht to execute arbitrary PHP code on the server.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
31.3.10-beta, 1.3.8, 1.3.9, …+ 2 more
- (no CPE)range: 1.3.10-beta, 1.3.8, 1.3.9, …
- cpe:2.3:a:impresscms:impresscms:1.4.4:*:*:*:*:*:*:*
- (no CPE)range: <1.4.4
Patches
Vulnerability mechanics
References
3- www.exploit-db.com/exploits/50890nvdExploitThird Party AdvisoryVDB Entry
- www.vulncheck.com/advisories/impresscms-unrestricted-file-uploadnvdThird Party Advisory
- www.impresscms.orgnvdProduct
News mentions
0No linked articles in our index yet.