PT-2026-66473 · E107 · E107

Usmon Khudoyorov · CVE-2026-57859 · Published 2026-07-30 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions e107 versions prior to 2.3.8

Description A code execution issue exists in the e array deserialization handler. An attacker with out-of-band database write access can execute arbitrary PHP code by storing a crafted payload in the user prefs column. The e array::unserialize() function in e107 handlers/core functions.php only checks for the 'array' prefix before passing the value to eval(), which triggers execution when user preferences are processed via e user pref::load().

Recommendations Update to version 2.3.8 or later.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-57859

GHSA-568X-W5QJ-VR7C

Affected Products

E107

References · 7

• 🔥 https://github.com/e107inc/e107/security/advisories/GHSA-568x-w5qj-vr7c · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57859.json · Exploit
• https://github.com/e107inc/e107/commit/40e73cefde85b32e1227dfac9956a5cb87046277 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-57859 · Security Note
• https://osv.dev/vulnerability/CVE-2026-57859 · Vendor Advisory
• https://github.com/e107inc/e107 · Note
• https://vulncheck.com/advisories/e107-second-order-code-execution-via-eval-based-deserialization-in-e-array-unserialize · Note