PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-55573 e107inc CVE debrief

CVE-2026-55573 is a critical vulnerability in e107, a content management system, that allows unauthenticated remote code execution via unsafe deserialization in install.php. The issue is fixed in version 2.3.7. This vulnerability affects e107 installations prior to version 2.3.7, and system administrators should assess exposure and prioritize upgrading. The vulnerability has a CVSS score of 9.8 and is considered critical. The e107 CMS has a POP chain vulnerability that can lead to full server compromise.

Vendor
e107inc
Product
e107
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-15
Advisory published
2026-10-14
Advisory updated
2026-10-15

Who should care

System administrators and security teams responsible for e107 installations should assess exposure and prioritize upgrading to version 2.3.7 or later. This vulnerability affects e107 installations prior to version 2.3.7, and system administrators should review compensating controls for exposed systems while remediation is scheduled and verified. Security teams should monitor for suspicious activity and verify system integrity. IT teams should track patch 2

Why it matters

CVE-2026-55573 is a critical vulnerability in e107 that allows unauthenticated remote code execution. Defenders should prioritize upgrading to version 2.3.7 or later, restrict access to install.php, and monitor for suspicious activity.

  • Potential for full server compromise
  • Unauthenticated remote code execution
  • Elevation of privileges to web server process level
  • Possible lateral movement within the network

Technical summary

The e107 CMS has a critical vulnerability (CVE-2026-55573) in install.php due to unsafe deserialization of the previous_steps POST parameter, allowing unauthenticated remote code execution via a POP chain. The issue is fixed in version 2.3.7. The vulnerability has a CVSS score of 9.8 and is considered critical. The e107 CMS is a content management system that is widely used. The vulnerability can lead to full server compromise if exploited. System administrators should assess exposure and prioritize upgrading to version 2.3.7 or later.

Defensive priority

High

Recommended defensive actions

  • Immediately upgrade to e107 version 2.3.7 or later
  • Restrict access to install.php
  • Monitor for suspicious activity
  • Verify system integrity
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its CVSS score of 9.8 and the affected versions of e107. The vendor, e107inc, has released a fixed version (2.3.7) and provided additional information via GitHub.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-55573 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-55573

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-55573 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-55573

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/55xxx/CVE-2026-55573.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/e107inc/e107/security/advisories/GHSA-c8h6-wpj3-4cr8

    Supplemental source - x_refsource_CONFIRM

  • Source reference

    Unverified legacy reference

    URL: https://github.com/e107inc/e107/commit/5d6d649e8cf01854d6024d07997c2449fdd75f24

    Supplemental source - x_refsource_MISC

  • Source reference

    Unverified legacy reference

    URL: https://github.com/e107inc/e107/commit/6c404295213952aedb9b3689be19dd4c7ba550b0

    Supplemental source - x_refsource_MISC

  • Source reference

    Unverified legacy reference

    URL: https://github.com/e107inc/e107/releases/tag/v2.3.7

    Supplemental source - x_refsource_MISC

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.