CVE-2022-50912

CRITICAL 9.8CVE-2022-50912 · Published 13/01/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
impresscms impresscms	`= 1.4.4`	No fix yet

Description

ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload potentially malicious files. Attackers can bypass file upload restrictions by using alternative file extensions .php2.php6.php7.phps.pht to execute arbitrary PHP code on the server.

References

ImpressCMS/impresscms · Product
exploit-db.com/exploits/50890 · Exploit
impresscms.org · Product
vulncheck.com/advisories/impresscms-unrestricted-file-upload · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free