CVE-2026-57859: e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()
e107 prior to version 2.3.8 contains a code execution vulnerability in the earray deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the userprefs column. The earray::unserialize() function in e107handlers/corefunctions.php performs only a prefix check for the string 'array' before passing the stored value to eval(), causing automatic PHP execution whenever the affected user's preferences are materialized through euserpref::load().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
e107to a version that resolves this vulnerability.Fixed in 2.3.8 - Compensating control
If you have out-of-band database write access concerns, restrict write access to the e107 database (e.g., limit who can modify the user_prefs column) so attacker-controlled payloads cannot be stored for second-order deserialization.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57859?
CVE-2026-57859 has a severity rating of high at 7.5.
How do I fix CVE-2026-57859?
To fix CVE-2026-57859, upgrade e107 to version 2.3.8 or later.
What type of vulnerability is CVE-2026-57859?
CVE-2026-57859 is a second-order code execution vulnerability due to flawed deserialization.
What impact does CVE-2026-57859 have?
CVE-2026-57859 allows an attacker with write access to execute arbitrary PHP code.
In which version of e107 is CVE-2026-57859 present?
CVE-2026-57859 is present in e107 versions prior to 2.3.8.