e107 CMS Users Urged to Update to 2.3.7 After Critical Unauthenticated RCE Vulnerability Discovered

Security operations teams managing web infrastructure must assess exposure to a critical flaw in e107 CMS. The National Vulnerability Database has assigned CVE-2026-55573 a CVSS score of 9.8, marking it as Critical. This vulnerability exists in the content management system's installation script, specifically affecting all versions prior to 2.3.7. The flaw allows unauthenticated attackers to execute arbitrary PHP functions with the privileges of the web server process, potentially leading to full server compromise.

How does the vulnerability function?

The exploit leverages the install.php file, which remains accessible on the server even after a standard installation is complete. According to the NVD record, the script decodes an attacker-controlled POST parameter named previous_steps and passes it to the unserialize function without restricting allowed classes. This occurs both at the file scope and within the e_install constructor. The lack of class restrictions enables an attacker to craft a specific object graph.

What is the technical impact?

An attacker can utilize the bundled GuzzleHttp\Psr7\PumpStream class to manipulate data flow through paths.hash into site_path. When string coercion occurs, it invokes an attacker-controlled callable. This chain of events allows for arbitrary code execution. Because the installer is exposed post-installation, any unauthenticated user who can reach the install.php endpoint can exploit this weakness. The result is execution of PHP functions with web server privileges, granting the attacker full control over the compromised server.

Which systems are affected?

The vulnerability impacts e107 CMS installations running versions older than 2.3.7. The vendor, e107inc, has addressed this issue in version 2.3.7. Organizations running older versions are exposed to this critical risk. The NVD record confirms that version 2.3.7 fixes the unsafe deserialization behavior. Teams should verify their current version against this threshold immediately to determine if they are vulnerable.

What is the current status?

A fix is available in e107 CMS version 2.3.7. The National Vulnerability Database confirms that this version resolves the issue described in CVE-2026-55573. There is no indication of active exploitation in the source material, but the severity rating suggests immediate attention is required. The vulnerability is classified under CWE-502, which relates to deserialization of untrusted data.

Questions to ask your suppliers

Teams usually need to verify whether third-party vendors maintain legacy software that includes this CMS. Check whether your suppliers have updated their hosted environments to the patched version. Determine who within your organization holds responsibility for patching these specific web applications. Ask if your suppliers conduct regular audits of installed scripts, particularly those that should be removed after initial setup. Ensure your incident response plan includes procedures for unauthenticated remote code execution scenarios.

What to do and how to stay safe: e107

• Verify the version of e107 CMS on all servers and compare it against 2.3.7.
• Restrict access to the install.php file if immediate patching is not possible.
• Monitor server logs for unusual activity related to deserialization or POST requests.
• Apply the vendor-provided update once confirmed to resolve the vulnerability.

Step-by-step guide: Vulnerability Scanning: What It Finds and What It Misses

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-55573?

The National Vulnerability Database rates the vulnerability as 9.8, which is Critical.

Which versions of e107 CMS are vulnerable?

All versions prior to 2.3.7 are affected by this flaw.

Is there a fix available?

Yes, the issue is fixed in version 2.3.7.