What is the CVSS score of CVE-2026-43936?

CVE-2026-43936 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-43936?

Yes, a patch is available for CVE-2026-43936. Update the affected software to the latest version immediately.

e107 CMS CVE-2026-43936

EUVD-2026-31847 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-26 GitHub_M

SSRF E107

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 12:24 vuln.today

Analysis Generated

Jun 08, 2026 - 12:24 vuln.today

Patch available

May 26, 2026 - 17:02 EUVD

DescriptionCVE.org

e107 is a content management system (CMS). Prior to 2.3.4, you can access the local environment by specifying the URL of the local environment from "Image/File URL:" of "From a remote location" in "Media Manager" on the administrator screen. This vulnerability is fixed in 2.3.4.

AnalysisAI

Server-Side Request Forgery (SSRF) in e107 CMS versions prior to 2.3.4 allows authenticated administrators to reach internal network resources by supplying IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1) in the Media Manager's remote URL fetch feature, bypassing PHP's private-range IP filter. The root cause is a normalization gap in file_class.php where PHP's filter_var with FILTER_FLAG_NO_PRIV_RANGE does not canonicalize IPv4-mapped IPv6 notation, leaving loopback and private ranges reachable. Publicly available exploit code exists per SSVC data, though EPSS sits at 0.03% (7th percentile) and the vulnerability is not listed in CISA KEV, indicating low observed exploitation volume.

Technical ContextAI

CWE-918 (Server-Side Request Forgery) describes the failure to validate or sanitize user-controlled URLs before the server issues outbound requests on the user's behalf. In e107 (CPE: cpe:2.3:a:e107inc:e107:*:*:*:*:*:*:*:*), the Media Manager's 'From a remote location' feature calls isUrlSafe() in e107_handlers/file_class.php, which resolves the supplied hostname to an IP and validates it using filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE). PHP's filter extension does not normalize IPv4-mapped IPv6 addresses of the form ::ffff:X.X.X.X before range evaluation, so ::ffff:127.0.0.1 passes the private-range check while the underlying network stack resolves it to the loopback address 127.0.0.1. The fix (commits 40b2d111 and 5f98cc9f) introduces a canonicalizeIp() helper that detects the 16-byte packed form with the ::ffff: prefix (10 zero bytes followed by 0xff 0xff) via inet_pton and rewrites the address to its embedded IPv4 form before validation, closing the bypass. This class of normalization bypass is a known PHP-specific pitfall with FILTER_FLAG_NO_PRIV_RANGE.

RemediationAI

Upgrade to e107 version 2.3.4, which contains the confirmed fix per the vendor advisory at https://github.com/e107inc/e107/security/advisories/GHSA-92fr-7h4f-22pp. The patch is implemented across two commits: 40b2d111 (canonicalizeIp normalization logic in file_class.php) and 5f98cc9f. If immediate upgrade is not feasible, administrators can restrict access to the Media Manager's remote URL fetch functionality by enforcing network-level egress filtering on the web server host to block outbound HTTP/HTTPS requests to RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and loopback (127.0.0.0/8); this compensating control prevents the server from reaching internal resources even if the URL validation is bypassed, but it may break legitimate use cases where the CMS needs to fetch images from internal CDNs. Alternatively, disabling the 'From a remote location' upload option in the Media Manager settings eliminates the attack surface entirely at the cost of that upload workflow.