CVE-2026-55573: e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain

Q: Which deployments are affected?

e107 versions prior to 2.3.7 are affected. The installer remains accessible after a normal installation, so systems are exposed if an attacker can reach install.php.

Q: Does exploitation require an account or user interaction?

No. An unauthenticated attacker can exploit the issue remotely when they can reach install.php; no user interaction is required.

Q: What is the remediation?

Upgrade e107 to version 2.3.7, which fixes the issue.

Published Oct 14, 2026

Updated

e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previoussteps POST parameter and passes it to unserialize() at file scope and again in the einstall constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into sitepath, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise. This issue is fixed in version 2.3.7.

Affected Software

1 affected component

e107 e107<2.3.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade e107 to a version that resolves this vulnerability.
Fixed in 2.3.7

Event History

Oct 14, 2026

CVE Published

via MITRE·06:12 PM

Data Sourced

via MITRE·06:12 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

e107 versions prior to 2.3.7 are affected. The installer remains accessible after a normal installation, so systems are exposed if an attacker can reach install.php.

Does exploitation require an account or user interaction?