Host Header Injection in e107 CMS Affects User Authentication

CVE-2026-43935

What is CVE-2026-43935?

The e107 content management system contains a vulnerability in its password reset functionality that allows attackers to exploit Host header values. Attackers can manipulate these headers to create password reset links directed towards malicious domains, enabling phishing attempts and the potential for unauthorized account access. This issue is prevalent in versions prior to 2.3.4 and poses a significant risk to user authentication mechanisms.

References