CVE-2026-55573

9.8Critical

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-502

Impact

Unauthenticated remote attackers can execute arbitrary code with web server privileges by sending a crafted POST request to install.php. They only need network reachability to the exposed installation script.

Root cause

The install.php script insecurely passes the attacker-controlled previous_steps parameter directly into unserialize() without restricting allowed classes, triggering a gadget chain in GuzzleHttp.

Affected systems

e107 versions prior to 2.3.7

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade e107 to version 2.3.7 or newer. As an immediate workaround, delete or restrict web access to the install.php file.

shell

$ rm -f /path/to/e107/install.php

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise. This issue is fixed in version 2.3.7.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-55573