CVE-2022-50993
CWE-434Published: April 30, 2026· Updated: Apr 30, 2026
Official Description
Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending multipart POST requests with arbitrary filenames and disguised content types. Attackers can upload PHP webshells to the Document directory and execute them via HTTP GET requests to achieve remote code execution as the web server user. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-10-10 (UTC).
Risk Analysis
Weaver (Fanwei) E-office versions prior to 10.0_20221201 are critically vulnerable to unauthenticated arbitrary file uploads. This allows remote attackers to upload malicious files, such as PHP webshells, and execute them to achieve remote code execution. With a CVSS score of 9.8, this is a severe vulnerability, and its presence in the KEV catalog confirms active exploitation.
Active exploitation of this vulnerability has been observed in the wild. The flaw is remotely exploitable without authentication, allowing attackers to upload and execute malicious files.
Upgrade Weaver (Fanwei) E-office to version 10.0_20221201 or later. Implement strict file upload validation and restrict execution permissions in web-accessible directories.
Technical Analysis
CVE-2022-50993 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.
CISA has added CVE-2022-50993 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
All References (4)
Quick Facts
Related CVEs (CWE-434)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2022-50993 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1