CVE-2026-57859: e107 CMS remote code execution in e_array deserialization

CVE-2026-57859 · Severity: high · CVSS 7.5 · Published 2026-07-30

e107 is a content management system (CMS) used to build and manage websites. A security flaw in how the system handles saved user settings allows for the execution of malicious code on the web server. To exploit this, an attacker must first have a way to modify the website's database directly; if successful, they can take full control of the server whenever a user logs in or accesses their profile.

Technologies: E107inc E107. Vendors: E107inc.

Quick answers

Is CVE-2026-57859 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57859 being exploited in the wild.
How severe is CVE-2026-57859?
High severity, with a CVSS score of 7.5, published 30 July 2026.
Which products and versions are affected?
E107inc E107 < 2.3.8.
Is there a fix for CVE-2026-57859?
A patch was published on 2026-07-30: Version 2.3.8 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57859 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-57859?
Check whether you run E107inc E107 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A deserialization vulnerability exists in the e_array::unserialize() function within e107_handlers/core_functions.php. The function attempts to reconstruct arrays stored in the var_export() format by prepending a variable assignment and passing the string to eval(). The only security validation performed is a prefix check for the literal string 'array'. While the application's standard UI prevents malicious writes, an attacker who can modify the 'user_prefs' column in the 'e107_user' table (via direct DB access or a separate SQL injection) can achieve remote code execution (RCE). The payload is triggered automatically when the affected user's preferences are loaded via e_user_pref::load(). This has been patched in version 2.3.8 by replacing eval() with a non-executing parser.

Affected products

  • e107inc e107 < 2.3.8

Timeline

  • 2026-07-21: advisory: GitHub Security Advisory published
  • 2026-07-30: disclosed: NVD publication date
  • 2026-07-30: patched: Version 2.3.8 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.