PatchSiren cyber security CVE debrief
CVE-2026-43935 e107inc CVE debrief
A Host Header Injection vulnerability in e107 CMS prior to version 2.3.4 allows attackers to manipulate password reset links by controlling the Host header, potentially enabling phishing attacks and account takeover. The vulnerability affects the password reset functionality, a critical authentication component. The issue was disclosed on 2026-05-26 and fixed in e107 version 2.3.4. Multiple commits address the vulnerability. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality and integrity with network attack vector, low attack complexity, no privileges required, and user interaction required.
- Vendor
- e107inc
- Product
- e107
- CVSS
- HIGH 8.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-26
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-26
- Advisory updated
- 2026-05-26
Who should care
Organizations running e107 CMS versions prior to 2.3.4; security teams responsible for web application authentication flows; system administrators managing e107 deployments; users with accounts on affected e107 installations
Technical summary
The e107 CMS password reset functionality prior to version 2.3.4 fails to properly validate the Host header when generating password reset emails. An attacker can supply a malicious Host header value that the application incorporates into password reset URLs sent to users. When recipients click these manipulated links, they are directed to attacker-controlled infrastructure while presenting legitimate-appearing reset tokens. This enables credential harvesting and account compromise. The vulnerability stems from reliance on client-supplied Host headers (CWE-807) without adequate input validation (CWE-20). Remediation involves upgrading to e107 2.3.4 and implementing server-level Host header validation.
Defensive priority
high
Recommended defensive actions
- Upgrade e107 CMS to version 2.3.4 or later to remediate this vulnerability
- Configure web server to validate Host headers and reject requests with unexpected or malformed Host values
- Implement additional email verification steps for password reset requests to reduce impact of potential link manipulation
- Review web server and reverse proxy configurations to ensure Host header is properly sanitized before reaching application
- Monitor authentication logs for anomalous password reset request patterns or reset link usage from unexpected referrers
Evidence notes
CVE published 2026-05-26T16:16:25.390Z; modified 2026-05-26T19:26:42.643Z. NVD status: Deferred. Fix version 2.3.4 confirmed in advisory. Three commits referenced for remediation. CWE-20 (Improper Input Validation) and CWE-807 (Reliance on Untrusted Inputs in a Security Decision) identified.
Official resources
2026-05-26