Read the docs
TI-2026-74376 Aliases CVE-2026-55573

Unsafe deserialization in e107 installer enables remote code execution

Priority HIGH 82CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

e107 CMS versions before 2.3.7 are affected. The install.php script passes attacker-controlled input to unserialize() without restricting allowed classes (CWE-502). An unauthenticated remote attacker who can reach install.php can execute arbitrary PHP functions with the web server's privileges, leading to full server compromise, because the installer remains accessible after a normal installation.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise. This issue is fixed in version 2.3.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00704 53rd percentileScored 2026-11-07
Fix Fixed e107 (e107inc): 2.3.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
e107ince107before 2.3.72.3.7Patch availableCNA
  • e107 Vendore107inc Affected before 2.3.7 Fixed in 2.3.7 Patch available CNA

Remediation

The fix is in e107 version 2.3.7, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA e107 (e107inc) Fixed in 2.3.7

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-55573
  2. 2026-10-16 CISA SSVC decision points changed
  3. 2026-10-16 Priority changed: MEDIUM → HIGH
  4. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Other 4

  • TI-2026-31992 e107: Host Header Injection in e107 password reset enables phishing CVSS 3.1HIGH 8.1
  • TI-2026-41663 e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize() CVSS 4.0HIGH 7.7
  • TI-2026-36251 e107: Command Injection via shell expansion in ImageMagick resize destination path CVSS 3.1HIGH 7.1
  • TI-2026-34276 e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check() CVSS 3.1MEDIUM 6.5
  • TI-2026-31991 e107: Broken Access Control in e107 comment edit allows cross-user comment modification CVSS 3.1MEDIUM 6.5
  • TI-2026-31993 e107: Server-Side Request Forgery (SSRF) in the remote file fetcher CVSS 3.1MEDIUM 4.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences