A vulnerability was detected in e107 CMS up to 2.3.3. This impacts an unknown function of the file /e107_admin/image.php?mode=main&action=avatar of the component Avatar Handler. Performing manipulation of the argument multiaction[] results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
| Link | Resource |
|---|---|
| https://note-hxlab.wetolink.com/share/igdVbDCk2IkD | Exploit Third Party Advisory |
| https://note-hxlab.wetolink.com/share/igdVbDCk2IkD#proof-of-concept- | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.329020 | Permissions Required VDB Entry |
| https://vuldb.com/?id.329020 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.671867 | Third Party Advisory VDB Entry |
Configurations
History
12 Jan 2026, 16:42
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://note-hxlab.wetolink.com/share/igdVbDCk2IkD - Exploit, Third Party Advisory | |
| References | () https://note-hxlab.wetolink.com/share/igdVbDCk2IkD#proof-of-concept- - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.329020 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.329020 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.671867 - Third Party Advisory, VDB Entry | |
| First Time |
E107
E107 e107 |
|
| CPE | cpe:2.3:a:e107:e107:*:*:*:*:*:*:*:* |
19 Oct 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-19 16:15
Updated : 2026-01-12 16:42
NVD link : CVE-2025-11941
Mitre link : CVE-2025-11941
CVE.ORG link : CVE-2025-11941
JSON object : View
Products Affected
e107
- e107
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')