Which versions of e107 CMS are affected by CVE-2026-57859?

e107 CMS versions prior to 2.3.8 contain a high-severity code execution vulnerability allowing attackers with database access to compromise entire systems through malicious code injection; no public…. A patch is available.

How to fix or mitigate CVE-2026-57859?

Within 24 hours, identify all e107 CMS instances running versions before 2.3.8, audit database access logs for unauthorized writes, and verify database security controls. Within 7 days, apply the vendor patch to upgrade all affected instances to e107 CMS version 2.3.8 or later, including comprehensive testing in non-production environments. Within 30 days, audit user preference data for suspicious serialized payloads, strengthen database access controls, and implement continuous monitoring to detect unauthorized database write activity.

e107 CMS CVE-2026-57859

Q: What is the CVSS score of CVE-2026-57859?

CVE-2026-57859 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-51123 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-30 VulnCheck

PHP RCE Deserialization E107 E107Inc

7.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.6 MEDIUM

AC:H and PR:H because exploitation requires prior out-of-band database write access, a high-privilege prerequisite; full C/I/A loss follows from arbitrary PHP eval execution.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 30, 2026 - 14:51 vuln.today

Analysis Generated

Jul 30, 2026 - 14:51 vuln.today

CVE Published

Jul 30, 2026 - 13:41 cve.org

HIGH 7.7

DescriptionCVE.org

e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the user_prefs column. The e_array::unserialize() function in e107_handlers/core_functions.php performs only a prefix check for the string 'array' before passing the stored value to eval(), causing automatic PHP execution whenever the affected user's preferences are materialized through e_user_pref::load().

AnalysisAI

Second-order PHP code execution in e107 CMS before version 2.3.8 lets an attacker who already holds out-of-band write access to the database plant a crafted payload in the user_prefs column, which is later fed to eval() when that user's preferences load. The e_array::unserialize() handler validates only that the stored string begins with 'array' before evaluating it, so any account whose preferences are materialized triggers arbitrary PHP execution. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

e107 is an open-source PHP/MySQL content management system. The flaw sits in e_array::unserialize() in e107_handlers/core_functions.php, which reconstructs stored preference arrays. Instead of a safe parser, it performs a naive prefix check for the literal string 'array' and then passes the value directly to PHP's eval(), so the serialized preference blob is treated as executable code. This maps to CWE-502 (Deserialization of Untrusted Data): the deserialization routine trusts attacker-influencable stored data. Execution is automatic and second-order - it occurs whenever e_user_pref::load() materializes the affected user's preferences (user_prefs column), decoupling payload injection from payload execution. Affected product per CPE is cpe:2.3:a:e107inc:e107 across all versions prior to 2.3.8.

RemediationAI

Upgrade to e107 2.3.8 or later, which contains the vendor fix referenced in commit 40e73cefde85b32e1227dfac9956a5cb87046277 (Patch available per vendor advisory; see GHSA-568x-w5qj-vr7c). Because exploitation depends on attacker-controlled writes to the user_prefs column, the strongest compensating controls until patching center on database exposure: restrict and audit direct database write access, ensure the CMS database account is not shared with other internet-facing services, and hunt for and remediate any SQL injection or exposed admin/DB paths that could provide the out-of-band write, since those are the realistic injection vectors. As a detective measure, inspect existing user_prefs values for entries beginning with 'array' that contain PHP code and purge them. Note the trade-off that tightening DB permissions can break plugins or integrations that legitimately write preference data, so validate in staging first.