Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.9

e107 User Preferences Code Execution Risk

CVE-2026-57859 · published 3 months ago
Summary

e107 versions before 2.3.8 are at risk of malicious code being executed from user preferences. An attacker with access to the database can store malicious code that will be executed when a user's preferences are loaded. Update to e107 version 2.3.8 or later to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
e107inc e107 <= 2.3.7
Original advisory text
e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()
e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the user_prefs column. The e_array::unserialize() function in e107_handlers/core_functions.php performs only a prefix check for the string 'array' before passing the stored value to eval(), causing automatic PHP execution whenever the affected user's preferences are materialized through e_user_pref::load().
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.9 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published30 Jul 2026
Updated4 Nov 2026
First seen30 Jul 2026
Sources
CVE-2026-57859 · NVD
CVE-2026-57859 · MITRE
CVE-2026-57859 · OSV
GHSA-568x-w5qj-vr7c · GHSA
Track software like this
Free during beta