Executive brief
e107 is a content management system (CMS) used to build and manage websites. A security flaw in how the system handles saved user settings allows for the execution of malicious code on the web server. To exploit this, an attacker must first have a way to modify the website's database directly; if successful, they can take full control of the server whenever a user logs in or accesses their profile.
Technical details
A deserialization vulnerability exists in the e_array::unserialize() function within e107_handlers/core_functions.php. The function attempts to reconstruct arrays stored in the var_export() format by prepending a variable assignment and passing the string to eval(). The only security validation performed is a prefix check for the literal string 'array'. While the application's standard UI prevents malicious writes, an attacker who can modify the 'user_prefs' column in the 'e107_user' table (via direct DB access or a separate SQL injection) can achieve remote code execution (RCE). The payload is triggered automatically when the affected user's preferences are loaded via e_user_pref::load(). This has been patched in version 2.3.8 by replacing eval() with a non-executing parser.
Affected products
- e107inc e107 < 2.3.8
Timeline
- 2026-07-21: advisory: GitHub Security Advisory published
- 2026-07-30: disclosed: NVD publication date
- 2026-07-30: patched: Version 2.3.8 released with fix
References
- https://github.com/e107inc/e107
- https://github.com/e107inc/e107/commit/40e73cefde85b32e1227dfac9956a5cb87046277
- https://github.com/e107inc/e107/security/advisories/GHSA-568x-w5qj-vr7c
- https://www.vulncheck.com/advisories/e107-second-order-code-execution-via-eval-based-deserialization-in-e-array-unserialize