Key points
- CVE-2026-55573 is rated Critical with a CVSS score of 9.8.
- The vulnerability exists in e107 CMS versions prior to 2.3.7.
- Attackers can execute arbitrary PHP code without authentication.
The e107 content management system has released a patch for a critical security flaw that allows attackers to take complete control of affected servers through a vulnerable installation script.
How it unfolded
- The National Vulnerability Database recorded CVE-2026-55573 as a critical issue with a CVSS score of 9.8.
- The flaw was identified in the `install.php` file of e107 CMS versions earlier than 2.3.7.
- The vendor released version 2.3.7 to fix the vulnerability and secure the installation process.
Who is affected
System administrators running e107 CMS on any version prior to 2.3.7 are exposed to this risk. According to the National Vulnerability Database, the issue affects the `install.php` script, which remains accessible on the server even after a standard installation is complete. This persistent access point allows unauthenticated attackers to target the script from the internet.
The vulnerability stems from how the script handles data. It decodes an attacker-controlled parameter named `previous_steps` and passes it to the `unserialize()` function. This occurs at the file scope and again within the `e_install` constructor. The code fails to restrict which classes can be processed during this deserialization step, creating a dangerous entry point for malicious activity.
An attacker can craft a specific object graph using the bundled `GuzzleHttp\Psr7\PumpStream` class. This crafted data flows through specific variables into the site path, where string coercion triggers an attacker-controlled callable. This chain of events allows the execution of arbitrary PHP functions with the privileges of the web server process, leading to full server compromise.
What happens next
The issue is fixed in version 2.3.7 of the e107 CMS. Administrators should update their installations to this version immediately to mitigate the risk. No other remediation steps are confirmed in the source material. Users of older versions remain vulnerable until they apply the vendor's update.
The background in plain language
Remote code execution flaws allow attackers to run commands on a server as if they were the system administrator. Unauthenticated vulnerabilities are especially dangerous because they do not require a password or login session to exploit. Deserialization issues occur when an application processes saved data without verifying its safety, potentially allowing malicious code to run when the data is loaded.
Background: Remote code execution vulnerabilities
Monitor for unexpected child processes, sudden spikes in outbound network traffic, and anomalous file creation. Combine static analysis with runtime behavior monitoring to catch execution attempts before they establish persistence or exfiltrate data.
Read the full guide: Detect Remote Code Execution: Signals, Tools, and Blind Spots
What to do and how to stay safe: e107 CMS
- Verify the current version of your e107 CMS installation and compare it to the fixed version 2.3.7.
- Update your content management system to version 2.3.7 or later as soon as possible.
- Monitor server logs for unusual activity or access attempts to installation scripts.
- Restrict access to installation files on the server if an immediate update is not feasible.
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-55573?
The National Vulnerability Database rates the vulnerability as Critical with a CVSS score of 9.8.
Which versions of e107 CMS are affected by this flaw?
All versions of e107 CMS prior to version 2.3.7 are affected by this vulnerability.
Is there a patch available for this issue?
Yes, the issue is fixed in version 2.3.7 of the e107 CMS.
