Read the docs
TI-2026-78761 Aliases CVE-2026-114407GHSA-26h5-jjjv-6774

e107 CMS Reflected XSS via search.php author Parameter

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

e107 CMS from 2.2.0 before 2.3.13 contains a reflected cross-site scripting flaw in search.php (CWE-79). The author GET parameter is parsed with parse_str() and concatenated unescaped into an HTML input tag. An unauthenticated remote attacker can craft a single GET request that breaks out of the tag and injects an img element with an onerror handler, executing arbitrary JavaScript in the victim's browser session.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parse_str() and concatenated unescaped into a rendered input tag via the form handler's 'other' option key. Attackers can craft a single GET request containing a crafted author parameter to break out of the HTML input tag and inject an img element with an onerror handler, executing arbitrary JavaScript in the victim's browser session.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00276 20th percentileScored 2026-11-07
Fix Fixed e107 (e107inc): 2.3.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
e107ince1072.2.0 to before 2.3.132.3.13Patch availableCNA
  • e107 Vendore107inc Affected 2.2.0 to before 2.3.13 Fixed in 2.3.13 Patch available CNA

Remediation

Upgrade e107 to version 2.3.13 or later, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA e107 (e107inc) Fixed in 2.3.13

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-114407
  2. 2026-10-21 CISA SSVC decision points changed
  3. 2026-10-21 Alias added: GHSA-26h5-jjjv-6774

References

Patch 1

Advisory 1

  • TI-2026-74376 Unsafe deserialization in e107 installer enables remote code execution CVSS 3.1CRITICAL 9.8
  • TI-2026-31992 e107: Host Header Injection in e107 password reset enables phishing CVSS 3.1HIGH 8.1
  • TI-2026-41663 e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize() CVSS 4.0HIGH 7.7
  • TI-2026-36251 e107: Command Injection via shell expansion in ImageMagick resize destination path CVSS 3.1HIGH 7.1
  • TI-2026-34276 e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check() CVSS 3.1MEDIUM 6.5
  • TI-2026-31991 e107: Broken Access Control in e107 comment edit allows cross-user comment modification CVSS 3.1MEDIUM 6.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences