PT-2026-43268 · E107 · E107

Scgajge12 · Published 2026-05-26 · Updated 2026-05-26 · CVE-2026-43936

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions e107 versions prior to 2.3.4

Description e107 is a content management system (CMS) that contains a Server-Side Request Forgery (SSRF) in the remote file fetcher. This issue allows access to the local environment by specifying a local environment URL within the "Image/File URL:" field of the "From a remote location" option in the "Media Manager" on the administrator screen. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations Update to version 2.3.4.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-43936

Affected Products

E107

References · 5

• 🔥 https://github.com/e107inc/e107/security/advisories/GHSA-92fr-7h4f-22pp · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-43936 · Security Note
• https://github.com/e107inc/e107/commit/5f98cc9f · Note
• https://github.com/e107inc/e107/commit/40b2d111 · Note
• https://t.me/CVEtracker/54979 · Telegram Post