# CVE-2026-57859: e107 CMS remote code execution in e_array deserialization

Source: https://junglewise.ai/threats/cve-2026-57859-e107-cms-remote-code-execution-in-e-array-deserialization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-57859 · Severity: high · CVSS 7.5 · Published 2026-07-30

e107 is a content management system (CMS) used to build and manage websites. A security flaw in how the system handles saved user settings allows for the execution of malicious code on the web server. To exploit this, an attacker must first have a way to modify the website's database directly; if successful, they can take full control of the server whenever a user logs in or accesses their profile.

Technologies: [E107inc E107](https://junglewise.ai/threats/technologies/e107). Vendors: [E107inc](https://junglewise.ai/threats/vendors/e107inc).

## Quick answers

**Is CVE-2026-57859 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57859 being exploited in the wild.

**How severe is CVE-2026-57859?** High severity, with a CVSS score of 7.5, published 30 July 2026.

**Which products and versions are affected?** E107inc E107 < 2.3.8.

**Is there a fix for CVE-2026-57859?** A patch was published on 2026-07-30: Version 2.3.8 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57859 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-57859?** Check whether you run E107inc E107 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A deserialization vulnerability exists in the e_array::unserialize() function within e107_handlers/core_functions.php. The function attempts to reconstruct arrays stored in the var_export() format by prepending a variable assignment and passing the string to eval(). The only security validation performed is a prefix check for the literal string 'array'. While the application's standard UI prevents malicious writes, an attacker who can modify the 'user_prefs' column in the 'e107_user' table (via direct DB access or a separate SQL injection) can achieve remote code execution (RCE). The payload is triggered automatically when the affected user's preferences are loaded via e_user_pref::load(). This has been patched in version 2.3.8 by replacing eval() with a non-executing parser.

## Affected products

- e107inc e107 < 2.3.8

## Timeline

- 2026-07-21: advisory: GitHub Security Advisory published
- 2026-07-30: disclosed: NVD publication date
- 2026-07-30: patched: Version 2.3.8 released with fix

## References

- [https://github.com/e107inc/e107](https://github.com/e107inc/e107)
- [https://github.com/e107inc/e107/commit/40e73cefde85b32e1227dfac9956a5cb87046277](https://github.com/e107inc/e107/commit/40e73cefde85b32e1227dfac9956a5cb87046277)
- [https://github.com/e107inc/e107/security/advisories/GHSA-568x-w5qj-vr7c](https://github.com/e107inc/e107/security/advisories/GHSA-568x-w5qj-vr7c)
- [https://www.vulncheck.com/advisories/e107-second-order-code-execution-via-eval-based-deserialization-in-e-array-unserialize](https://www.vulncheck.com/advisories/e107-second-order-code-execution-via-eval-based-deserialization-in-e-array-unserialize)

## Related threats

- [e107 CMS reflected XSS in search author parameter](https://junglewise.ai/threats/cve-2026-114407-e107-cms-before-2-3-13-contains-a-reflected-cross-site-scripting)
- [e107 SQL injection in alt_auth authentication backends](https://junglewise.ai/threats/cve-2026-55572-e107-is-a-content-management-system-cms-prior-to-2-3-7-the)
- [e107 CMS command injection in ImageMagick resize destination path](https://junglewise.ai/threats/cve-2026-48997-e107-cms-command-injection-in-imagemagick-resize-destination-path)
- [e107 CMS CSRF in comment moderation endpoints](https://junglewise.ai/threats/cve-2026-46620-e107-cms-csrf-in-comment-moderation-endpoints)
- [e107 SSRF in Media Manager remote file fetcher](https://junglewise.ai/threats/cve-2026-43936-e107-ssrf-in-media-manager-remote-file-fetcher)