Is CVE-2021-47937 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-47937 being exploited in the wild.

How severe is CVE-2021-47937?

High severity, with a CVSS score of 8.8, published 10 May 2026.

Is there a fix for CVE-2021-47937?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2021-47937 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2021-47937?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-47937: e107 CMS remote code execution via theme upload

CVE-2021-47937 · Severity: high · CVSS 8.8 · Published 2026-05-10

e107 CMS is an open-source content management system used to build and manage websites. A security flaw allows an authorized user with theme-management permissions to upload a malicious file that grants them full control over the web server. This could lead to a complete site takeover, theft of sensitive customer data, or the use of the server to launch further attacks.

Quick answers

Is CVE-2021-47937 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-47937 being exploited in the wild.
How severe is CVE-2021-47937?: High severity, with a CVSS score of 8.8, published 10 May 2026.
Which products and versions are affected?: e107 e107 CMS 2.3.0.
Is there a fix for CVE-2021-47937?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2021-47937 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2021-47937?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A remote code execution (RCE) vulnerability exists in e107 CMS version 2.3.0 due to unrestricted file upload (CWE-434) in the theme management component. An authenticated attacker with privileges to install themes can bypass security checks by uploading a specially crafted ZIP archive containing a PHP web shell through the theme.php endpoint. Once uploaded, the malicious script is extracted into the e107_themes directory, allowing the attacker to execute arbitrary system commands with the privileges of the web server user. While the vendor has released newer versions (e.g., 2.3.8), users on version 2.3.0 are specifically vulnerable.

Affected products

e107 e107 CMS 2.3.0

Timeline

2021-09-21: disclosed: Initial discovery and exploit publication on Exploit-DB
2026-05-10: advisory: NVD/VulnCheck advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.