PT-2025-41591 · E107 Cms · E107 Cms

Xancatos · Published 2025-10-10 · Updated 2025-10-11 · CVE-2025-61505

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions e107 CMS versions through 2.3.3

Description The software contains a flaw due to insecure deserialization in the install.php script. The script processes user-controlled input received in the previous steps POST parameter using unserialize(base64 decode()) without proper validation. Successful exploitation of this issue could result in remote code execution, arbitrary file operations, or denial of service, contingent on the presence of PHP object gadgets within the codebase.

Recommendations Update to a version beyond 2.3.3.

Fix

DoS

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-61505

Affected Products

E107 Cms

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-61505 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61505 · Vendor Advisory
• https://github.com/e107inc/e107/blob/master/install.php · Note
• https://xancatos.org/cve202561505 · Note
• https://twitter.com/VulmonFeeds/status/1976809465212002358 · Twitter Post
• https://twitter.com/CVEnew/status/1976723482701348868 · Twitter Post