Executive brief
e107 is a content management system (CMS) used to build and manage websites. A security flaw in its password reset system allows attackers to manipulate the links sent in reset emails. If a user clicks a manipulated link, they could be directed to a fake website designed to steal their login credentials, potentially leading to full account takeover.
Technical details
A Host Header Injection vulnerability exists in e107's password reset functionality (fpw.php). The application fails to properly validate the HTTP Host header and uses it to construct the absolute URL for password reset links sent via email. An attacker can submit a password reset request for a target user while supplying a malicious Host header; the resulting email will contain a reset token appended to the attacker's domain. If the victim clicks the link, the secret token is leaked to the attacker's server, enabling account takeover. The fix in version 2.3.4 ensures that reset links are built from the configured 'siteurl' preference rather than the untrusted Host header, and it refuses to process requests if the site URL is not properly configured.
Affected products
- e107inc e107 < 2.3.4
Timeline
- 2026-05-05: advisory: GitHub Security Advisory GHSA-7pmw-jwvr-cq2x published
- 2026-05-26: disclosed: CVE-2026-43935 published to NVD
- 2026-05-26: patched: Fixed in version 2.3.4
References
- https://github.com/e107inc/e107/commit/04511f9f1d6e97c31ba7cc5bf7f1f9a19d221db6
- https://github.com/e107inc/e107/commit/b0dee8234e273debbf7a8ae054de464f1008f357
- https://github.com/e107inc/e107/commit/c4f9f71b0fd695545d0f09e2277b6f70ff4660fc
- https://github.com/e107inc/e107/security/advisories/GHSA-7pmw-jwvr-cq2x