Remote Code Execution Vulnerability in e107 CMS by e107 Inc.
CVE-2026-55573
9.8CRITICAL
What is CVE-2026-55573?
A remote code execution vulnerability in e107, a popular content management system, allows an unauthenticated attacker to exploit the install.php file. Prior to version 2.3.7, the application fails to properly handle user-input from the previous_steps POST parameter, allowing for unserialize attacks without restrictions. If an attacker reaches the install.php script, they can craft a malicious object graph that leads to arbitrary PHP function execution under the web server's privileges. This poses a significant risk as it can result in complete server compromise, highlighting the importance of upgrading to version 2.3.7 or later.
Affected Version(s)
e107 < 2.3.7