CVE-2026-57859 Details
Description
e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the user_prefs column. The e_array::unserialize() function in e107_handlers/core_functions.php performs only a prefix check for the string 'array' before passing the stored value to eval(), causing automatic PHP execution whenever the affected user's preferences are materialized through e_user_pref::load().
A code execution vulnerability has been identified in e107 versions prior to 2.3.8. The issue arises in the e_array deserialization handler, where the function e_array::unserialize() in e107_handlers/core_functions.php performs a minimal check before passing data to eval(). This flaw allows an attacker with out-of-band database write access to execute arbitrary PHP code by injecting a crafted payload into the user_prefs column. The vulnerability is triggered when the affected user's preferences are loaded, executing the injected code as the web server user.
Users are advised to update to e107 version 2.3.8 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/e107inc/e107/security/advisories/GHSA-568x-w5qj-vr7c | CISA-ADP | AdvisoryRemedy |
| https://github.com/e107inc/e107 | [email protected] | Source CodeVendor |
| https://github.com/e107inc/e107/commit/40e73cefde85b32e1227dfac9956a5cb87046277 | [email protected] | Source CodeVendor |
| https://github.com/e107inc/e107/security/advisories/GHSA-568x-w5qj-vr7c | [email protected] | AdvisoryRemedy |
| https://www.vulncheck.com/advisories/e107-second-order-code-execution-via-eval-based-deserialization-in-e-array-unserialize | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| e107 | <= 2.3.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |