CVE-2025-61505: Medium severity e107 CMS vulnerability
e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the install.php script. The script processes user-controlled input in the previoussteps POST parameter using unserialize(base64decode()) without validation, allowing attackers to craft malicious serialized data. This could lead to remote code execution, arbitrary file operations, or denial of service, depending on available PHP object gadgets in the codebase.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61505?
CVE-2025-61505 has been classified as a critical vulnerability due to the potential for remote code execution through insecure deserialization.
How do I fix CVE-2025-61505?
To fix CVE-2025-61505, update e107 CMS to a version later than 2.3.3 where the insecure deserialization issue is resolved.
What types of attacks can exploit CVE-2025-61505?
CVE-2025-61505 can be exploited through attacks that involve sending crafted serialized data via the `previous_steps` POST parameter to execute arbitrary code.
Who is affected by CVE-2025-61505?
CVE-2025-61505 affects all versions of e107 CMS up to and including 2.3.3 that utilize the `install.php` script.
Is there a workaround for CVE-2025-61505?
A preliminary workaround for CVE-2025-61505 is to disable access to the `install.php` script if an update cannot be applied immediately.