CVE-2026-55573: e107 CMS: Unauthenticated remote code execution via unsafe deserialization in installer

Summary

e107 versions before 2.3.7 deserialize attacker-controlled data in install.php without restricting allowed classes. The installer remains reachable after a normal installation, so an unauthenticated attacker who can reach the file can use a crafted object chain via the bundled GuzzleHttp PumpStream class to execute arbitrary PHP functions. The attacker then gains the privileges of the web server process, which can lead to full server compromise.

Affected

e107 versions before 2.3.7 (VulDB describes the range as up to 2.3.6)

Fixed in

Upgrade to e107 2.3.7 or, preferably, the latest release (the vendor release index names v2.3.8 as urgent for sites on 2.3.7 or earlier; check the vendor site for the current version)

Workaround

Delete install.php on installed sites (the vendor's listed mitigation)
If deletion is not possible, deny access to install.php at the web server
Limit network access to the web server where possible

Exploitation

CVSS 9.8 (CRITICAL); CISA SSVC: exploitation status PoC, automatable yes, technical impact total
No known exploitation in the wild; no public exploit found, but the gadget chain is described publicly in general terms
Not listed in CISA KEV according to a third-party tracker (not verified against the catalog)

Our recommendation

Check immediately whether any e107 site is running a version below 2.3.7
Update to the latest e107 release, not only 2.3.7
Delete or block access to install.php on all production sites
Review web server logs for requests to install.php with POST parameter previous_steps
Check sites for unexpected files or changes and rotate database and server credentials if compromise is suspected

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

GitHub Security Advisory GHSA-c8h6-wpj3-4cr8 github.com
e107 v2.3.7 release github.com
Fix commit 5d6d649 github.com
Fix commit 6c40429 github.com
e107 release index github.com
e107 v2.3.13 release github.com
VulDB entry 420282 vuldb.com
OpenCVE CVE-2026-55573 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:56.

Original description (NVD)

e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise. This issue is fixed in version 2.3.7.

NVD references (5)

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed