CVE-2022-50898
NanoCMS 0.4 - Remote Code Execution (RCE) (Authenticated)
HIGH 8.6EPSS 1.3%
NanoCMS 0.4 contains an authenticated file upload vulnerability that allows remote code execution through unvalidated page content creation. Authenticated attackers can upload PHP files with arbitrary code to the server's pages directory by exploiting the page creation mechanism without proper input sanitization.
- Affected
- kalyan02 · NanoCMS
- CVSS v4.0 VULNCHECK
- 8.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS v3.1 VULNCHECK
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- 1.32% chance of exploitation in the next 30 days, 70th percentile
- Published
- 2026-01-13
- Updated
- 2026-01-29
Proof-of-concept exploits (2)
- https://www.exploit-db.com/exploits/50997
- ishell/Exploits-Archives/blob/master/2009-exploits/0904-exploits/nanocms-multi.txt64★ · 2014-04-08
Security advisories
- https://www.vulncheck.com/advisories/nanocms-remote-code-execution-rce-authenticated
- kalyan02/NanoCMS