What is the CVSS score of CVE-2026-43935?

CVE-2026-43935 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of e107 CMS are affected by CVE-2026-43935?

e107 CMS versions prior to version 2.3.4 are vulnerable to administrator account compromise through password reset email poisoning, enabling attackers to gain complete control over affected content…. A patch is available.

How to fix or mitigate CVE-2026-43935?

24 hours: Identify all systems running e107 CMS and determine current versions; notify system owners and administrators. 7 days: Upgrade all e107 CMS instances to version 2.3.4 or later; validate successful patching and test password reset functionality. 30 days: Review administrator account access logs for the vulnerability window; reset all administrator credentials as a precaution.

e107 CMS CVE-2026-43935

EUVD-2026-31850 HIGH

Improper Input Validation (CWE-20)

2026-05-26 GitHub_M

Code Injection E107

8.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 10:03 vuln.today

Analysis Generated

Jun 08, 2026 - 10:03 vuln.today

Patch available

May 26, 2026 - 17:02 EUVD

DescriptionCVE.org

e107 is a content management system (CMS). Prior to 2.3.4, a Host Header Injection vulnerability in the password reset page allows attackers to manipulate the Host header to generate password reset links pointing to attacker-controlled domains. This can lead to phishing attacks, account takeover, or other security risks. The severity is high, as the vulnerability affects a critical function related to user authentication. This vulnerability is fixed in 2.3.4.

AnalysisAI

Host Header Injection in e107 CMS versions prior to 2.3.4 allows remote attackers to poison password reset emails by manipulating the HTTP Host header, producing reset links that point to attacker-controlled domains. Successful exploitation enables credential harvesting and full account takeover, including administrator accounts, when a victim clicks the malicious reset link. Publicly available exploit code exists per SSVC, though EPSS (0.13%) suggests low broad-scale exploitation activity and the issue is not on the CISA KEV list.

Technical ContextAI

e107 is an open-source PHP-based content management system. The root cause is CWE-20 (Improper Input Validation), specifically the fpw.php password reset flow constructing reset URLs from the runtime SITEURL constant, which derived its host from the unvalidated HTTP Host header sent by the requesting client. The fix (commits 04511f9, b0dee82, c4f9f71) replaces that derivation with the administrator-configured 'siteurl' preference and aborts the reset flow with a LAN_FPW_MISCONFIGURED error if that preference is unset, removing attacker influence over the link host.

RemediationAI

Vendor-released patch: upgrade e107 to version 2.3.4 or later, which sources the reset link host from the administrator-configured 'siteurl' preference rather than the request Host header and blocks the reset flow when that preference is empty (see GHSA-7pmw-jwvr-cq2x and commits 04511f9, b0dee82, c4f9f71 in the e107inc/e107 repository). If immediate upgrade is not feasible, ensure the 'siteurl' preference is explicitly configured and place the e107 site behind a reverse proxy or web server (nginx/Apache) configured to reject or normalize requests whose Host header does not match the canonical site domain - this neutralizes Host header tampering at the edge but may break multi-domain deployments. As an additional compensating control, monitor outbound password reset emails for links whose host differs from the canonical site and alert administrators, accepting that this is detective rather than preventive.