CVE-2022-24977: Impresscms

Critical severity, CVSS 9.8. EPSS: 6.4% chance of exploitation in the next 30 days.

ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHP_SESSION_UPLOAD_PROGRESS when the PHP installation supports upload_progress.

Affected products

• Impresscms Impresscms: before 1.4.2 (fixed in 1.4.2)

Published 2022-02-14. Last modified 2026-06-17.