We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2022-50898

CVE-2022-50898

PHP

Severity: HIGH
CVSS: 8.8CVSS
Published: 2026-01-13
Last modified: 2026-01-29
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-434

Description

NanoCMS 0.4 contains an authenticated file upload vulnerability that allows remote code execution through unvalidated page content creation. Authenticated attackers can upload PHP files with arbitrary code to the server's pages directory by exploiting the page creation mechanism without proper input sanitization.

References

https://github.com/ishell/Exploits-Archives/blob/master/2009-exploits/0904-exploits/nanocms-multi.txt
https://github.com/kalyan02/NanoCMS
https://www.exploit-db.com/exploits/50997
https://www.vulncheck.com/advisories/nanocms-remote-code-execution-rce-authenticated

Summary

Description

References