Authenticated administrative users can exploit a file upload vulnerability in e107 CMS version 3.2.1 to bypass security restrictions and execute arbitrary PHP code on the server.

The application fails to properly validate file types and paths within the Media Manager import feature. By manipulating the upload URL parameter, an authenticated administrator can upload malicious PHP files to parent directories, resulting in remote code execution.

A successful exploitation of this vulnerability grants an attacker full control over the web server, leading to potential data exfiltration, total system compromise, and unauthorized modification of site content. Given the CVSS score of 8.8, this represents a high risk to organizational security, particularly because it provides a direct path for an attacker with administrative access to escalate their control to the underlying host infrastructure.

Immediate Action: Update e107 CMS to the latest patched version available from the official vendor website. Ensure that the Media Manager functionality is restricted to trusted users only until the patch is applied.

Proactive Monitoring: Review web server and application logs for suspicious file upload activity, particularly requests involving the Media Manager import feature or unexpected file extensions being saved to parent directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious file upload attempts and restrict access to administrative endpoints to known, trusted IP addresses.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the Exploit Database (EDB-ID 50910).

This vulnerability presents a significant risk due to the potential for remote code execution. Administrators must prioritize updating their e107 CMS instances to the latest version immediately to eliminate this attack vector. Failure to patch allows any compromised or malicious administrative account to fully seize control of the application server.