CVE-2022-24977

ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHP_SESSION_UPLOAD_PROGRESS when the PHP installation supports upload_progress.

• CWE-22

• https://github.com/ImpressCMS/impresscms/commit/a66d7bb499faafab803e24833606028fa0ba4261Patch, Third Party Advisory
• https://github.com/ImpressCMS/impresscms/compare/1.4.1...v1.4.2Patch, Third Party Advisory
• https://r0.haxors.org/posts?id=8Exploit, Third Party Advisory
• https://github.com/ImpressCMS/impresscms/commit/a66d7bb499faafab803e24833606028fa0ba4261Patch, Third Party Advisory
• https://github.com/ImpressCMS/impresscms/compare/1.4.1...v1.4.2Patch, Third Party Advisory
• https://r0.haxors.org/posts?id=8Exploit, Third Party Advisory

Published

Feb 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24971This vulnerability allows remote attackers to execute arbitr…8.8
• CVE-2022-24972This vulnerability allows network-adjacent attackers to disc…6.5
• CVE-2022-24973This vulnerability allows network-adjacent attackers to exec…8
• CVE-2022-24974Links may not be rewritten according to policy in some speci…5.3
• CVE-2022-24975The --mirror documentation for Git through 2.35.1 does not m…7.5
• CVE-2022-24976Atheme IRC Services before 7.2.12, when used in conjunction …9.1
• CVE-2022-24978Zoho ManageEngine ADAudit Plus before 7055 allows authentica…8.8
• CVE-2022-24979An issue was discovered in the Varnishcache extension before…5.3
• CVE-2022-2498An issue in pipeline subscriptions in GitLab EE affecting al…7.5
• CVE-2022-24980An issue was discovered in the Kitodo.Presentation (aka dif)…7.5
• CVE-2022-24981A reflected cross-site scripting (XSS) vulnerability in form…6.1
• CVE-2022-24982Forms generated by JQueryForm.com before 2022-02-05 allows a…6.5