CVE-2026-43935: e107 CMS Host Header Injection in password reset page

CVE-2026-43935 · Severity: high · CVSS 8.1 · Published 2026-05-26

e107 is a content management system (CMS) used to build and manage websites. A security flaw in its password reset system allows attackers to manipulate the links sent in reset emails. If a user clicks a manipulated link, they could be directed to a fake website designed to steal their login credentials, potentially leading to full account takeover.

Technologies: E107inc E107. Vendors: E107inc.

Quick answers

Is CVE-2026-43935 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-43935 being exploited in the wild.
How severe is CVE-2026-43935?
High severity, with a CVSS score of 8.1, published 26 May 2026.
Which products and versions are affected?
E107inc E107 < 2.3.4.
Is there a fix for CVE-2026-43935?
A patch was published on 2026-05-26: Fixed in version 2.3.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43935 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-43935?
Check whether you run E107inc E107 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Host Header Injection vulnerability exists in e107's password reset functionality (fpw.php). The application fails to properly validate the HTTP Host header and uses it to construct the absolute URL for password reset links sent via email. An attacker can submit a password reset request for a target user while supplying a malicious Host header; the resulting email will contain a reset token appended to the attacker's domain. If the victim clicks the link, the secret token is leaked to the attacker's server, enabling account takeover. The fix in version 2.3.4 ensures that reset links are built from the configured 'siteurl' preference rather than the untrusted Host header, and it refuses to process requests if the site URL is not properly configured.

Affected products

  • e107inc e107 < 2.3.4

Timeline

  • 2026-05-05: advisory: GitHub Security Advisory GHSA-7pmw-jwvr-cq2x published
  • 2026-05-26: disclosed: CVE-2026-43935 published to NVD
  • 2026-05-26: patched: Fixed in version 2.3.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.