Read the docs
TI-2010-00957 Aliases CVE-2010-0996GHSA-fhp7-79wc-6xf2

Unrestricted file upload vulnerability in e107 before 0.7.20 allows remote authenticated…

Priority LOW 31Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Unrestricted file upload vulnerability in e107 before 0.7.20 allows remote authenticated users to execute arbitrary code by uploading a .php.filetypesphp file. NOTE: the vendor disputes the significance of this issue, noting that "an odd set of preferences and a missing file" are required.

Why it matters now

EPSS 0.01897 79th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 66

CPEVersionsRoleVendor
cpe:2.3:a:e107:e107:*:*:*:*:*:*:*:*up to 0.7.19Vulnerablee107
cpe:2.3:a:e107:e107:0.7:*:*:*:*:*:*:*0.7Vulnerablee107
cpe:2.3:a:e107:e107:0.7.1:*:*:*:*:*:*:*0.7.1Vulnerablee107
cpe:2.3:a:e107:e107:0.7.2:*:*:*:*:*:*:*0.7.2Vulnerablee107
cpe:2.3:a:e107:e107:0.7.3:*:*:*:*:*:*:*0.7.3Vulnerablee107
cpe:2.3:a:e107:e107:0.7.4:*:*:*:*:*:*:*0.7.4Vulnerablee107
cpe:2.3:a:e107:e107:0.7.5:*:*:*:*:*:*:*0.7.5Vulnerablee107
cpe:2.3:a:e107:e107:0.7.6:*:*:*:*:*:*:*0.7.6Vulnerablee107
cpe:2.3:a:e107:e107:0.7.7:*:*:*:*:*:*:*0.7.7Vulnerablee107
cpe:2.3:a:e107:e107:0.7.8:*:*:*:*:*:*:*0.7.8Vulnerablee107
  • cpe:2.3:a:e107:e107:*:*:*:*:*:*:*:* Versions up to 0.7.19 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.7:*:*:*:*:*:*:* Versions 0.7 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.7.1:*:*:*:*:*:*:* Versions 0.7.1 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.7.2:*:*:*:*:*:*:* Versions 0.7.2 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.7.3:*:*:*:*:*:*:* Versions 0.7.3 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.7.4:*:*:*:*:*:*:* Versions 0.7.4 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.7.5:*:*:*:*:*:*:* Versions 0.7.5 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.7.6:*:*:*:*:*:*:* Versions 0.7.6 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.7.7:*:*:*:*:*:*:* Versions 0.7.7 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.7.8:*:*:*:*:*:*:* Versions 0.7.8 Vulnerable ·e107
Show 56 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:e107:e107:0.7.9:*:*:*:*:*:*:*0.7.9Vulnerablee107
cpe:2.3:a:e107:e107:0.7.10:*:*:*:*:*:*:*0.7.10Vulnerablee107
cpe:2.3:a:e107:e107:0.7.11:*:*:*:*:*:*:*0.7.11Vulnerablee107
cpe:2.3:a:e107:e107:0.7.12:*:*:*:*:*:*:*0.7.12Vulnerablee107
cpe:2.3:a:e107:e107:0.7.13:*:*:*:*:*:*:*0.7.13Vulnerablee107
cpe:2.3:a:e107:e107:0.7.14:*:*:*:*:*:*:*0.7.14Vulnerablee107
cpe:2.3:a:e107:e107:0.7.15:*:*:*:*:*:*:*0.7.15Vulnerablee107
cpe:2.3:a:e107:e107:0.7.16:*:*:*:*:*:*:*0.7.16Vulnerablee107
cpe:2.3:a:e107:e107:0.7.17:*:*:*:*:*:*:*0.7.17Vulnerablee107
cpe:2.3:a:e107:e107:0.7.18:*:*:*:*:*:*:*0.7.18Vulnerablee107
cpe:2.3:a:e107:e107:0.545:*:*:*:*:*:*:*0.545Vulnerablee107
cpe:2.3:a:e107:e107:0.547:beta:*:*:*:*:*:*0.547 betaVulnerablee107
cpe:2.3:a:e107:e107:0.548:beta:*:*:*:*:*:*0.548 betaVulnerablee107
cpe:2.3:a:e107:e107:0.549:beta:*:*:*:*:*:*0.549 betaVulnerablee107
cpe:2.3:a:e107:e107:0.551:beta:*:*:*:*:*:*0.551 betaVulnerablee107
cpe:2.3:a:e107:e107:0.552:beta:*:*:*:*:*:*0.552 betaVulnerablee107
cpe:2.3:a:e107:e107:0.553:beta:*:*:*:*:*:*0.553 betaVulnerablee107
cpe:2.3:a:e107:e107:0.554:*:*:*:*:*:*:*0.554Vulnerablee107
cpe:2.3:a:e107:e107:0.554:beta:*:*:*:*:*:*0.554 betaVulnerablee107
cpe:2.3:a:e107:e107:0.555:beta:*:*:*:*:*:*0.555 betaVulnerablee107
cpe:2.3:a:e107:e107:0.600:*:*:*:*:*:*:*0.600Vulnerablee107
cpe:2.3:a:e107:e107:0.601:*:*:*:*:*:*:*0.601Vulnerablee107
cpe:2.3:a:e107:e107:0.602:*:*:*:*:*:*:*0.602Vulnerablee107
cpe:2.3:a:e107:e107:0.603:*:*:*:*:*:*:*0.603Vulnerablee107
cpe:2.3:a:e107:e107:0.604:*:*:*:*:*:*:*0.604Vulnerablee107
cpe:2.3:a:e107:e107:0.605:*:*:*:*:*:*:*0.605Vulnerablee107
cpe:2.3:a:e107:e107:0.606:*:*:*:*:*:*:*0.606Vulnerablee107
cpe:2.3:a:e107:e107:0.607:*:*:*:*:*:*:*0.607Vulnerablee107
cpe:2.3:a:e107:e107:0.608:*:*:*:*:*:*:*0.608Vulnerablee107
cpe:2.3:a:e107:e107:0.609:*:*:*:*:*:*:*0.609Vulnerablee107
cpe:2.3:a:e107:e107:0.610:*:*:*:*:*:*:*0.610Vulnerablee107
cpe:2.3:a:e107:e107:0.611:*:*:*:*:*:*:*0.611Vulnerablee107
cpe:2.3:a:e107:e107:0.612:*:*:*:*:*:*:*0.612Vulnerablee107
cpe:2.3:a:e107:e107:0.613:*:*:*:*:*:*:*0.613Vulnerablee107
cpe:2.3:a:e107:e107:0.614:*:*:*:*:*:*:*0.614Vulnerablee107
cpe:2.3:a:e107:e107:0.615:*:*:*:*:*:*:*0.615Vulnerablee107
cpe:2.3:a:e107:e107:0.615a:*:*:*:*:*:*:*0.615aVulnerablee107
cpe:2.3:a:e107:e107:0.616:*:*:*:*:*:*:*0.616Vulnerablee107
cpe:2.3:a:e107:e107:0.617:*:*:*:*:*:*:*0.617Vulnerablee107
cpe:2.3:a:e107:e107:0.6171:*:*:*:*:*:*:*0.6171Vulnerablee107
cpe:2.3:a:e107:e107:0.6172:*:*:*:*:*:*:*0.6172Vulnerablee107
cpe:2.3:a:e107:e107:0.6173:*:*:*:*:*:*:*0.6173Vulnerablee107
cpe:2.3:a:e107:e107:0.6174:*:*:*:*:*:*:*0.6174Vulnerablee107
cpe:2.3:a:e107:e107:0.6175:*:*:*:*:*:*:*0.6175Vulnerablee107
cpe:2.3:a:e107:e107:5.1:*:*:*:*:*:*:*5.1Vulnerablee107
cpe:2.3:a:e107:e107:5.3:beta:*:*:*:*:*:*5.3 betaVulnerablee107
cpe:2.3:a:e107:e107:5.3:beta2:*:*:*:*:*:*5.3 beta2Vulnerablee107
cpe:2.3:a:e107:e107:5.04:*:*:*:*:*:*:*5.04Vulnerablee107
cpe:2.3:a:e107:e107:5.4:beta1:*:*:*:*:*:*5.4 beta1Vulnerablee107
cpe:2.3:a:e107:e107:5.4:beta2:*:*:*:*:*:*5.4 beta2Vulnerablee107
cpe:2.3:a:e107:e107:5.4:beta3:*:*:*:*:*:*5.4 beta3Vulnerablee107
cpe:2.3:a:e107:e107:5.4:beta4:*:*:*:*:*:*5.4 beta4Vulnerablee107
cpe:2.3:a:e107:e107:5.4:beta5:*:*:*:*:*:*5.4 beta5Vulnerablee107
cpe:2.3:a:e107:e107:5.4:beta6:*:*:*:*:*:*5.4 beta6Vulnerablee107
cpe:2.3:a:e107:e107:5.05:*:*:*:*:*:*:*5.05Vulnerablee107
cpe:2.3:a:e107:e107:5.21:*:*:*:*:*:*:*5.21Vulnerablee107
  • cpe:2.3:a:e107:e107:0.7.9:*:*:*:*:*:*:* Versions 0.7.9 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.7.10:*:*:*:*:*:*:* Versions 0.7.10 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.7.11:*:*:*:*:*:*:* Versions 0.7.11 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.7.12:*:*:*:*:*:*:* Versions 0.7.12 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.7.13:*:*:*:*:*:*:* Versions 0.7.13 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.7.14:*:*:*:*:*:*:* Versions 0.7.14 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.7.15:*:*:*:*:*:*:* Versions 0.7.15 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.7.16:*:*:*:*:*:*:* Versions 0.7.16 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.7.17:*:*:*:*:*:*:* Versions 0.7.17 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.7.18:*:*:*:*:*:*:* Versions 0.7.18 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.545:*:*:*:*:*:*:* Versions 0.545 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.547:beta:*:*:*:*:*:* Versions 0.547 beta Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.548:beta:*:*:*:*:*:* Versions 0.548 beta Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.549:beta:*:*:*:*:*:* Versions 0.549 beta Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.551:beta:*:*:*:*:*:* Versions 0.551 beta Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.552:beta:*:*:*:*:*:* Versions 0.552 beta Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.553:beta:*:*:*:*:*:* Versions 0.553 beta Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.554:*:*:*:*:*:*:* Versions 0.554 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.554:beta:*:*:*:*:*:* Versions 0.554 beta Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.555:beta:*:*:*:*:*:* Versions 0.555 beta Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.600:*:*:*:*:*:*:* Versions 0.600 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.601:*:*:*:*:*:*:* Versions 0.601 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.602:*:*:*:*:*:*:* Versions 0.602 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.603:*:*:*:*:*:*:* Versions 0.603 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.604:*:*:*:*:*:*:* Versions 0.604 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.605:*:*:*:*:*:*:* Versions 0.605 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.606:*:*:*:*:*:*:* Versions 0.606 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.607:*:*:*:*:*:*:* Versions 0.607 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.608:*:*:*:*:*:*:* Versions 0.608 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.609:*:*:*:*:*:*:* Versions 0.609 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.610:*:*:*:*:*:*:* Versions 0.610 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.611:*:*:*:*:*:*:* Versions 0.611 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.612:*:*:*:*:*:*:* Versions 0.612 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.613:*:*:*:*:*:*:* Versions 0.613 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.614:*:*:*:*:*:*:* Versions 0.614 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.615:*:*:*:*:*:*:* Versions 0.615 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.615a:*:*:*:*:*:*:* Versions 0.615a Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.616:*:*:*:*:*:*:* Versions 0.616 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.617:*:*:*:*:*:*:* Versions 0.617 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.6171:*:*:*:*:*:*:* Versions 0.6171 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.6172:*:*:*:*:*:*:* Versions 0.6172 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.6173:*:*:*:*:*:*:* Versions 0.6173 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.6174:*:*:*:*:*:*:* Versions 0.6174 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:0.6175:*:*:*:*:*:*:* Versions 0.6175 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:5.1:*:*:*:*:*:*:* Versions 5.1 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:5.3:beta:*:*:*:*:*:* Versions 5.3 beta Vulnerable ·e107
  • cpe:2.3:a:e107:e107:5.3:beta2:*:*:*:*:*:* Versions 5.3 beta2 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:5.04:*:*:*:*:*:*:* Versions 5.04 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:5.4:beta1:*:*:*:*:*:* Versions 5.4 beta1 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:5.4:beta2:*:*:*:*:*:* Versions 5.4 beta2 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:5.4:beta3:*:*:*:*:*:* Versions 5.4 beta3 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:5.4:beta4:*:*:*:*:*:* Versions 5.4 beta4 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:5.4:beta5:*:*:*:*:*:* Versions 5.4 beta5 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:5.4:beta6:*:*:*:*:*:* Versions 5.4 beta6 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:5.05:*:*:*:*:*:*:* Versions 5.05 Vulnerable ·e107
  • cpe:2.3:a:e107:e107:5.21:*:*:*:*:*:*:* Versions 5.21 Vulnerable ·e107

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-0996
  2. 2026-10-03 Alias added: GHSA-fhp7-79wc-6xf2

References

Patch 1

Advisory 1

Other 1

  • TI-2022-26359 e107 CMS v3.2.1 - Reflected XSS via Comment Flow CVSS 3.1CRITICAL 9.8
  • TI-2022-26369 e107 CMS v3.2.1 - Upload restriction bypass (Authenticated [Admin])+ Server file override CVSS 4.0HIGH 8.7
  • TI-2022-26391 e107 CMS v3.2.1 - Upload Restriction Bypass with Path Traversal File Override CVSS 4.0HIGH 8.6
  • TI-2022-26361 e107 CMS v3.2.1 - Admin Upload Restriction Bypass + RCE CVSS 4.0HIGH 8.6
  • TI-2023-18122 Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute… CVSS 3.1MEDIUM 5.4
  • TI-2025-10948 e107 CMS Avatar image.php path traversal CVSS 4.0MEDIUM 5.3
See all 76 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences