CVE-2026-55573

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55573

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55573.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-55573

Aliases

GHSA-c8h6-wpj3-4cr8

Published

2026-10-14T18:12:58Z

Modified

2026-10-15T02:47:36Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain

Details

e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise. This issue is fixed in version 2.3.7.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-502"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55573.json"
}

References

Affected packages

Git / github.com/e107inc/e107

Affected ranges

Type

GIT

Repo

https://github.com/e107inc/e107

Events

Introduced

Fixed

0fbef3cd2480570cc5511ece25a3974256d334ca

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.3.7"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v2.*

v2.0-beta1

v2.0alpha

v2.1.1

v2.1.2

v2.1.3

v2.1.4

v2.1.5

v2.1.6

v2.1.7

v2.1.8

v2.1.9

v2.2.0

v2.2.1

v2.3.0

v2.3.0-rc1

v2.3.1

v2.3.2

v2.3.3

v2.3.4

v2.3.5

v2.3.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55573.json"