Executive brief
e107 CMS is an open-source content management system used to build and manage websites. A security flaw allows an authorized user with theme-management permissions to upload a malicious file that grants them full control over the web server. This could lead to a complete site takeover, theft of sensitive customer data, or the use of the server to launch further attacks.
Technical details
A remote code execution (RCE) vulnerability exists in e107 CMS version 2.3.0 due to unrestricted file upload (CWE-434) in the theme management component. An authenticated attacker with privileges to install themes can bypass security checks by uploading a specially crafted ZIP archive containing a PHP web shell through the theme.php endpoint. Once uploaded, the malicious script is extracted into the e107_themes directory, allowing the attacker to execute arbitrary system commands with the privileges of the web server user. While the vendor has released newer versions (e.g., 2.3.8), users on version 2.3.0 are specifically vulnerable.
Affected products
- e107 e107 CMS 2.3.0
Timeline
- 2021-09-21: disclosed: Initial discovery and exploit publication on Exploit-DB
- 2026-05-10: advisory: NVD/VulnCheck advisory published