CVE-2022-44036: b2evolution CMS

High severity, CVSS 7.2. EPSS: 1.1% chance of exploitation in the next 30 days.

In b2evolution 7.2.5, if configured with admins_can_manipulate_sensitive_files, arbitrary file upload is allowed for admins, leading to command execution. NOTE: the vendor's position is that this is "very obviously a feature not an issue and if you don't like that feature it is very obvious how to disable it."

Affected products

• b2evolution b2evolution CMS: version 7.2.5 only

Published 2023-01-03. Last modified 2026-06-17.