CVE-2026-55573

Deferred Deferred - Pending Action

Remote Code Execution in e107 CMS

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise. This issue is fixed in version 2.3.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-55573

EUVD

EUVD-2026-101532

Affected Vendors & Products

Vendor	Product	Version / Range
e107inc	e107	< 2.3.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability is a remote code execution flaw in the e107 CMS installer. It occurs because the install.php file decodes and deserializes attacker-controlled input from the previous_steps POST parameter without proper validation. This allows an attacker to inject a malicious PHP object payload that triggers arbitrary code execution via a property-oriented programming chain, compromising the server.

Detection Guidance

Check if install.php is accessible on your e107 server by accessing it via a web browser or using curl commands. If the file is accessible after installation, it indicates potential exposure. Use network scans to detect unusual POST requests to install.php with base64-encoded data in the previous_steps parameter.

Impact Analysis

An unauthenticated attacker who can access install.php can execute arbitrary PHP functions with the web server's privileges. This leads to full server compromise, allowing theft of sensitive data, installation of malware, or lateral movement within a network. The vulnerability remains exploitable even after normal installation.

Compliance Impact

This vulnerability allows unauthenticated remote code execution, which could lead to unauthorized access to sensitive data. For GDPR, this may result in data breaches requiring notification under Article 33. For HIPAA, it could expose protected health information, violating the Security Rule. Both standards mandate safeguards against such exploits.

Mitigation Strategies

Upgrade e107 to version 2.3.7 or later immediately. If upgrading is not possible, remove or rename install.php from the server and ensure the .htaccess file blocks access to it. Isolate the system from the public internet if immediate patching is not feasible.

Hi! I’m here to help you understand CVE-2026-55573. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70