E107 vulnerabilities
We track 5 vulnerabilities in E107 products across 3 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on August 11, 2026.
Latest E107 vulnerabilities
- 9.8 Critical severity
e107: Improper Neutralization of Special Elements used in an SQL Command
An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can read, mod
- 7.2 High severity
e107 CMS: Improper Limitation of a Pathname to a Restricted Directory
e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server files through path traversal. The vulnerability exists in the Media Manager's remote URL upload functionality (image.php)
- 7.2 High severity
e107 CMS: Unrestricted Upload of File with Dangerous Type
e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrators to override server files through the Media Manager import functionality. Attackers can exploit the upload mechanism by manipulating the upload URL parameter to
- 7.2 High severity
e107 CMS: Unrestricted Upload of File with Dangerous Type
e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files. Attackers can upload malicious PHP files to parent directories by manipulating the upload URL parame
- 8.1 High severity
CMS: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was detected in e107 CMS up to 2.3.3. This impacts an unknown function of the file /e107_admin/image.php?mode=main&action=avatar of the component Avatar Handler. Performing manipulation of the argument multiaction[] results in path traversal. I