HOMEVULNERABILITIESCVE-2022-50993
CRITICALCISA KEVIN THE WILD

CVE-2022-50993

CWE-434Published: April 30, 2026· Updated: Apr 30, 2026

9.8
CVSS v3.1
EPSS:0.21%probability of exploitation in 30 daysPercentile:43.8th

Official Description

Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending multipart POST requests with arbitrary filenames and disguised content types. Attackers can upload PHP webshells to the Document directory and execute them via HTTP GET requests to achieve remote code execution as the web server user. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-10-10 (UTC).

NVD Source

Risk Analysis

Weaver (Fanwei) E-office versions prior to 10.0_20221201 are critically vulnerable to unauthenticated arbitrary file uploads. This allows remote attackers to upload malicious files, such as PHP webshells, and execute them to achieve remote code execution. With a CVSS score of 9.8, this is a severe vulnerability, and its presence in the KEV catalog confirms active exploitation.

Active exploitation of this vulnerability has been observed in the wild. The flaw is remotely exploitable without authentication, allowing attackers to upload and execute malicious files.

Recommended Action

Upgrade Weaver (Fanwei) E-office to version 10.0_20221201 or later. Implement strict file upload validation and restrict execution permissions in web-accessible directories.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2022-50993 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.

CISA has added CVE-2022-50993 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorNetwork
Attack ComplexityLow
Privileges Req.None
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Vendors & Products

Mentioned vendors (from description):
PHP
CPE data not yet available in NVD for this CVE.

Exploit & PoC Resources

ACTIVE EXPLOITATIONConfirmed exploitation in the wild
External links open in a new tab. Always verify in a controlled environment before use.

All References (4)

Quick Facts

CVE IDCVE-2022-50993
CVSS Score9.8 / 10
SeverityCRITICAL
WeaknessCWE-434
CISA KEVYES — Active Exploitation
ExploitIN THE WILD
EPSS (30d)0.21%
PublishedApr 30, 2026

Related CVEs (CWE-434)

Recommended Actions

  • Apply vendor patches immediately
  • Monitor CVE-2022-50993 in threat intel feeds
  • Review IDS/IPS signatures for exploitation attempts
  • !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
  • !Active exploitation confirmed — treat as P1
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.