e107 CMS v3.2.1 - 上传限制绕过与路径遍历文件覆盖

该漏洞的潜在影响非常严重。攻击者可以利用此漏洞上传恶意文件，覆盖关键配置文件，甚至执行任意代码。攻击者可以完全控制受影响的 e107 CMS 实例，窃取敏感数据，篡改网站内容，或将其用作进一步攻击其他系统的跳板。由于该漏洞需要管理员权限，但一旦获得权限，攻击者可以造成广泛的破坏。类似于其他文件上传漏洞，攻击者可能利用此漏洞上传webshell，从而获得对服务器的远程访问。

e107 CMS installations running version 3.2.1 are directly at risk. Websites utilizing the Media Manager's remote URL upload feature, particularly those with administrative accounts that have weak passwords or are otherwise vulnerable to compromise, are especially susceptible. Shared hosting environments that run e107 CMS are also at increased risk, as a compromise of one site could potentially affect others on the same server.

• php: Examine web server access logs for requests to image.php with suspicious upload_caption parameters containing directory traversal sequences (e.g., ../../../). • php: Review e107 CMS configuration files for any unusual modifications or unexpected file paths. • generic web: Use curl to test the image.php endpoint with various upload_caption values containing directory traversal sequences to identify potential vulnerabilities.

curl -X POST -d "upload_caption=../../../etc/passwd" http://your-e107-site/image.php

1. 2026-01-13Disclosure

   disclosure

1. 已保留2026-01-11
2. 发布日期2026-01-13
3. 修改日期2026-04-07
4. EPSS 更新日期2026-03-23

由于该漏洞影响特定版本，最有效的缓解措施是立即升级到修复后的版本。如果无法立即升级，可以考虑以下缓解措施：限制上传文件类型，严格验证上传文件名，并禁用媒体管理器的远程 URL 上传功能。此外，实施 Web 应用防火墙 (WAF) 规则，以检测和阻止包含目录遍历序列的上传请求。定期审查 e107 CMS 的配置，确保其遵循安全最佳实践。