CVE-2026-114407 e107inc CVE debrief

Who should care

e107 CMS administrators, security teams, and users of the affected versions should assess exposure and prioritize patching or mitigation to prevent exploitation. This includes reviewing and restricting input to the author parameter in search.php, implementing additional security measures to prevent cross-site scripting attacks, and verifying the patch status of their deployments.

Why it matters

CVE-2026-114407 is a reflected cross-site scripting vulnerability in e107 CMS before version 2.3.13. The vulnerability allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php. This is achieved by parsing the parameter with parse_str() and concatenating it unescaped into a rendered input tag via the form handler's 'other' option key. Attackers can craft a single GET request containing a crafted author parameter to break out of the HTML input tag and inject an img element with an onerror handler, executing arbitrary JavaScript in the victim's browser session. e107 CMS administrators and security teams should assess exposure and prioritize patching or mitigation to prevent exploitation.

• Potential for unauthenticated attackers to inject malicious HTML and execute arbitrary JavaScript
• Possible impact on user sessions and data security
• Need for prompt patching or mitigation to prevent exploitation

Technical summary

The vulnerability is caused by the use of parse_str() to parse the author GET parameter in search.php, which is then concatenated unescaped into a rendered input tag. This allows attackers to inject malicious HTML and execute arbitrary JavaScript in the victim's browser session. The affected product is e107 CMS before version 2.3.13, and administrators and security teams should assess exposure and prioritize patching or mitigation to prevent exploitation. The vulnerability can be exploited by crafting a single GET request containing a crafted author parameter to break out of the HTML input tag and inject an img element with an onerror handler.

Defensive priority

Medium priority for e107 CMS administrators and security teams

Recommended defensive actions

• Update e107 CMS to version 2.3.13 or later
• Review and restrict input to the author parameter in search.php
• Implement additional security measures to prevent cross-site scripting attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor advisories and patches. e107 CMS administrators and security teams should verify the patch status of their deployments and review input handling for the author parameter in search.php. Defensive verification tasks include confirming the presence of vendor-supported updates, assessing exposure, and implementing additional security measures to prevent cross-site scripting attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.