e107: Host Header Injection in e107 password reset enables phishing
Priority HIGH 70CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
e107 is a content management system (CMS). Prior to 2.3.4, a Host Header Injection vulnerability in the password reset page allows attackers to manipulate the Host header to generate password reset links pointing to attacker-controlled domains. This can lead to phishing attacks, account takeover, or other security risks. The severity is high, as the vulnerability affects a critical function related to user authentication. This vulnerability is fixed in 2.3.4.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00297 22nd percentileScored 2026-11-07
Fix Fixed e107 (e107inc): 2.3.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA e107 (e107inc) Fixed in 2.3.4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-43935
References
Other 4
- https://github.com/e107inc/e107/security/advisories/GHSA-7pmw-jwvr-cq2x
- https://github.com/e107inc/e107/commit/04511f9f1d6e97c31ba7cc5bf7f1f9a19d221db6
- https://github.com/e107inc/e107/commit/b0dee8234e273debbf7a8ae054de464f1008f357
- https://github.com/e107inc/e107/commit/c4f9f71b0fd695545d0f09e2277b6f70ff4660fc
More e107inc vulnerabilities
- TI-2026-74376 Unsafe deserialization in e107 installer enables remote code execution CVSS 3.1CRITICAL 9.8
- TI-2026-41663 e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize() CVSS 4.0HIGH 7.7
- TI-2026-36251 e107: Command Injection via shell expansion in ImageMagick resize destination path CVSS 3.1HIGH 7.1
- TI-2026-34276 e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check() CVSS 3.1MEDIUM 6.5
- TI-2026-31991 e107: Broken Access Control in e107 comment edit allows cross-user comment modification CVSS 3.1MEDIUM 6.5
- TI-2026-31993 e107: Server-Side Request Forgery (SSRF) in the remote file fetcher CVSS 3.1MEDIUM 4.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences