Unauthenticated RCE in e107 CMS Install Script Compromises Server Privileges

Malicious actors targeting e107 content management systems can execute arbitrary PHP functions with the privileges of the web server process. According to the National Vulnerability Database, this capability leads to full server compromise. The threat stems from how the installer handles user input, allowing unauthenticated attackers to inject crafted object graphs that invoke attacker-controlled callables.

How it unfolded

• The vulnerability, identified as CVE-2026-55573, was documented in the NVD record with a CVSS score of 9.8.
• Analysis shows that install.php decodes an attacker-controlled previous_steps POST parameter and passes it to unserialize().
• This occurs at file scope and within the e_install constructor without restricting allowed classes, enabling the exploit chain.
• The issue is fixed in version 2.3.7, according to the NVD record.

Who is affected

Organisations running e107 CMS versions earlier than 2.3.7 are exposed to this critical remote code execution flaw. The vulnerability is particularly dangerous because the installer remains accessible after a normal installation is completed. Any unauthenticated attacker who can reach the install.php endpoint can trigger the exploit. This means public-facing sites using older versions of the software are at immediate risk of full server takeover.

The fix

The vendor, e107inc, has addressed this issue in version 2.3.7. The source material states that this issue is fixed in version 2.3.7. Administrators must upgrade to this specific version to mitigate the risk. No other patches or temporary workarounds are mentioned in the source material.

What analysts watch for

Security teams usually monitor for unexpected POST requests to installation scripts on production servers. Analysts examine logs for serialized data payloads, particularly those invoking classes like PumpStream. They check whether installation files remain accessible post-deployment, as this is a common misconfiguration. Teams also look for signs of arbitrary code execution, such as new processes spawned by the web server. Reviewing file integrity helps detect if attackers have dropped web shells or modified core files.

Background: Web shells

Isolate the affected server immediately to cut off remote access. Do not simply delete the suspicious file, as the underlying vulnerability remains. Identify the entry point, patch the software, and restore services from a known clean backup after verifying integrity.

Read the full guide: Web Shell Removal: Containment, Eradication and Recovery

What to do and how to stay safe: e107

• Verify your e107 CMS version and upgrade to 2.3.7 or later immediately.
• Restrict access to the install.php file using web server configuration rules if upgrading is delayed.
• Monitor server logs for unusual activity related to the installation script or unexpected PHP function calls.
• Ensure that installation directories are removed or disabled after the initial setup is complete.

Step-by-step guide: Patch Management: Eight Questions Answered for Stability

General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2026-55573?

The National Vulnerability Database rates CVE-2026-55573 as critical with a CVSS score of 9.8.

Which versions of e107 are vulnerable?

All versions of e107 CMS prior to 2.3.7 are affected by this unauthenticated remote code execution flaw.

Is authentication required to exploit this vulnerability?

No, the source material states that an unauthenticated attacker who can reach install.php can execute arbitrary PHP functions.