Code Execution Vulnerability in e107 by e107 Inc.

CVE-2026-57859

What is CVE-2026-57859?

The e107 content management system versions prior to 2.3.8 are susceptible to a code execution vulnerability due to improper handling of object deserialization in the e_array class. Attackers with access to database write operations can manipulate the user_prefs column by storing carefully crafted payloads. The flaw lies in the e_array::unserialize() function, which only performs a basic prefix check on the 'array' string before passing the value to eval(). This design oversight allows unauthorized execution of arbitrary PHP code when the affected user preferences are loaded, potentially compromising the security of the application and its data.

References