RCE in SiteServer CMS

CRITICAL 9.8CVE-2022-28118 · GHSA-q469-j32f-h7vm · Published 03/05/2022 · updated 09/07/2026

In short

CVE-2022-28118 is a CRITICAL (CVSS 9.8) vulnerability affecting siteserver cms (sscms), siteserver.
Chance of exploitation in the next 30 days (EPSS): 2.8%, higher than 86.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
siteserver cms sscms	`≥ 7.0.0, ≤ 7.1.2`	No fix yet
siteserver npm	`≥ 7.0.0`	No fix yet

SiteServer CMS v7.x, which SiteServer UI relies on, allows attackers to execute arbitrary code via a crafted plug-in.

NVD description

SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≥ 7.0.0, ≤ 7.1.2

No fix yet

npm

≥ 7.0.0

No fix yet

More vulnerabilities in siteserver cms

See all →