EUVD-2026-31847Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
e107 is a content management system (CMS). Prior to 2.3.4, you can access the local environment by specifying the URL of the local environment from "Image/File URL:" of "From a remote location" in "Media Manager" on the administrator screen. This vulnerability is fixed in 2.3.4.
AnalysisAI
Server-Side Request Forgery (SSRF) in e107 CMS versions prior to 2.3.4 allows authenticated administrators to reach internal network resources by supplying IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1) in the Media Manager's remote URL fetch feature, bypassing PHP's private-range IP filter. The root cause is a normalization gap in file_class.php where PHP's filter_var with FILTER_FLAG_NO_PRIV_RANGE does not canonicalize IPv4-mapped IPv6 notation, leaving loopback and private ranges reachable. Publicly available exploit code exists per SSVC data, though EPSS sits at 0.03% (7th percentile) and the vulnerability is not listed in CISA KEV, indicating low observed exploitation volume.
Technical ContextAI
CWE-918 (Server-Side Request Forgery) describes the failure to validate or sanitize user-controlled URLs before the server issues outbound requests on the user's behalf. In e107 (CPE: cpe:2.3:a:e107inc:e107:*:*:*:*:*:*:*:*), the Media Manager's 'From a remote location' feature calls isUrlSafe() in e107_handlers/file_class.php, which resolves the supplied hostname to an IP and validates it using filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE). PHP's filter extension does not normalize IPv4-mapped IPv6 addresses of the form ::ffff:X.X.X.X before range evaluation, so ::ffff:127.0.0.1 passes the private-range check while the underlying network stack resolves it to the loopback address 127.0.0.1. The fix (commits 40b2d111 and 5f98cc9f) introduces a canonicalizeIp() helper that detects the 16-byte packed form with the ::ffff: prefix (10 zero bytes followed by 0xff 0xff) via inet_pton and rewrites the address to its embedded IPv4 form before validation, closing the bypass. This class of normalization bypass is a known PHP-specific pitfall with FILTER_FLAG_NO_PRIV_RANGE.
RemediationAI
Upgrade to e107 version 2.3.4, which contains the confirmed fix per the vendor advisory at https://github.com/e107inc/e107/security/advisories/GHSA-92fr-7h4f-22pp. The patch is implemented across two commits: 40b2d111 (canonicalizeIp normalization logic in file_class.php) and 5f98cc9f. If immediate upgrade is not feasible, administrators can restrict access to the Media Manager's remote URL fetch functionality by enforcing network-level egress filtering on the web server host to block outbound HTTP/HTTPS requests to RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and loopback (127.0.0.0/8); this compensating control prevents the server from reaching internal resources even if the URL validation is bypassed, but it may break legitimate use cases where the CMS needs to fetch images from internal CDNs. Alternatively, disabling the 'From a remote location' upload option in the Media Manager settings eliminates the attack surface entirely at the cost of that upload workflow.
e107 CMS 3.2.1 has multiple XSS vulnerabilities in news comments that allow executing arbitrary JavaScript. Rated CVSS 9
usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism. Rated high severity (CVSS 8.8), thi
e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including admini
e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to overrid
e107 2.1.1 allows SQL injection by remote authenticated administrators via the pagelist parameter to e107_admin/menus.ph
e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upl
e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrators to override server
e107_web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php
Cross-site request forgery (CSRF) vulnerability in e107_admin/newspost.php in e107 1.0.1 allows remote attackers to hija
Multiple cross-site request forgery (CSRF) vulnerabilities in e107_admin/download.php in e107 1.0.2 allow remote attacke
e107 2.1.8 has XSS via the e107_admin/users.php?mode=main&action=list user_loginname parameter. Rated medium severity (C
SQL injection in e107 CMS version 2.4.0 (and earlier) lets unauthenticated remote attackers inject arbitrary SQL through
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today