e107 CMS EUVD-2026-101532

The decisive prerequisite is that install.php remains reachable on the target: the advisory states the installer stays accessible after a normal installation, which is why an unauthenticated attacker who can reach that endpoint can exploit it against affected default deployments of e107 prior to 2.3.7. No authentication, user interaction, or special configuration is required (PR:N/UI:N). The limiting factor is deployment hygiene - sites that have deleted install.php or placed it behind access controls/network restrictions after setup are not exploitable, so realistic exposure is confined to installations that left the installer endpoint publicly reachable. The patch addresses this by positively detecting a completed installation and requiring a signed, HMAC-verified provisioning token instead of trusting unserialized client state.

All provided severity signals point the same direction: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw with full C:H/I:H/A:H impact, and the vulnerability class (CWE-502 PHP object injection via unserialize() without allowed_classes) with a known reachable gadget chain (GuzzleHttp\Psr7\PumpStream → paths.hash → site_path string coercion → arbitrary callable) makes reliable RCE realistic rather than theoretical. This is a genuine high-priority issue, not a high-CVSS/low-real-risk case. HOWEVER, several corroborating signals are absent from the input: no EPSS exploitation-probability score was supplied, there is no CISA KEV listing (so no confirmed active exploitation), and no POC flag was set - therefore 'no public exploit identified at time of analysis' despite the published commit diffs and a unit test (pumpStreamPayload) that demonstrate the gadget path. The practical risk is gated by one real-world prerequisite the CVSS vector does not capture: install.php must still be reachable on the target. Because the description states the installer remains accessible after a normal installation, many default deployments are expected to be exposed, which keeps real-world risk high; sites that deleted or access-restricted install.php are not exploitable. Net: treat as urgent-patch given unauthenticated RCE and a demonstrated gadget, but note exploitation is widespread-capable only where the installer endpoint is exposed.

An unauthenticated attacker locates a running e107 site (prior to 2.3.7) whose install.php remains reachable after setup and sends a crafted POST request whose previous_steps parameter encodes a serialized GuzzleHttp\Psr7\PumpStream object graph. When install.php unserialize()s this input without class restrictions, the object flows through paths.hash into site_path where string coercion invokes an attacker-controlled callable, executing arbitrary PHP as the web server user. No public weaponized exploit is identified at time of analysis, but patch commit diffs and a unit test publicly demonstrate the gadget path, lowering the bar to reproduce.