Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55573— e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain

Quick assessment

Affected
e107inc e107
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

e107 是一个内容管理系统（CMS）。在 2.3.7 版本之前，install.php 会解码攻击者可控的 previous_steps POST 参数，并在文件作用域和 e_install 构造函数中将其传递给 unserialize()，且未限制允许反序列化的类。即使完成正常安装后，安装脚本 install.php 仍然可访问。攻击者可以利用打包的 GuzzleHttp\Psr7\PumpStream 类构造恶意对象图，该对象图可通过 paths.hash 流转到 site_path，并在其中通过字符串强制类

CVSS 9.8 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
e107inc e107 < 2.3.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55573

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain
Source: CVE Program / CVE List V5
Vulnerability Description
e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise. This issue is fixed in version 2.3.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
e107inc e107 < 2.3.7 -

II. Public POCs for CVE-2026-55573

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55573

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55573 (1)

Other References for CVE-2026-55573 (2)

IV. Related Vulnerabilities

Same product: e107
Same vendor: e107inc
Same weakness: CWE-502

V. Comments for CVE-2026-55573

No comments yet

Leave a comment