External risk intelligence

e107 CMS Install Script Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-55573

The vulnerability resides in the install.php file of a content management system (CMS). While the installer is typically intended to be removed or restricted post-deployment, it is a web-accessible component of a public-facing web application framework. Because CMS installations are commonly internet-reachable and this specific component is often inadvertently left accessible, it represents a likely internet-facing surface.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the e107 content management system, specifically within its installation script. This flaw allows unauthenticated attackers to execute arbitrary code on servers running affected versions, potentially leading to a complete compromise. The main concern is confirming if our organization utilizes this specific technology and, if so, understanding the extent of potential exposure.

Flaw allows attackers to run any code on the server.
Website installer left accessible is a common oversight.
Confirm e107 usage and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can target the `install.php` script of the e107 CMS. By sending a specially crafted POST request, an attacker can manipulate the `previous_steps` parameter, leading to the deserialization of attacker-controlled data. This process can exploit a vulnerable class, ultimately allowing the attacker to execute arbitrary PHP functions on the server.

Unauthenticated network access to `install.php`.
Triggered by a crafted `previous_steps` POST parameter.
Leads to arbitrary code execution as the web server.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an unauthenticated attacker could execute arbitrary PHP functions with the web server process's privileges by exploiting a flaw in the `install.php` file. This could lead to a full server compromise.

Website code and server access.
Crafted object graph via `install.php`.
Full server compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this critical vulnerability in the e107 content management system. The first step is to identify all instances of e107, confirm their reachability and business criticality, and then determine the accountable owner to plan remediation.

Confirm ownership and assess exposure.
Verify reachability and business criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the e107 software affected by CVE-2026-55573?

e107 is a content management system (CMS) used to build and manage dynamic websites. It provides a framework for handling user accounts, content, and site functionality. This vulnerability affects the system's installation script, which is typically used during the initial setup process to configure database connections and site settings.

What does deserialization mean in the context of this flaw?

This CVE involves CWE-502, or Deserialization of Untrusted Data. In plain terms, the application takes complex data sent by a user and converts it back into an active object that the server processes. Because the application does not verify this incoming data, an attacker can supply a malicious object that tricks the server into running unintended, harmful functions.

How is this vulnerability triggered by an attacker?

An attacker triggers the vulnerability by sending a specific POST request to the install.php file with a manipulated 'previous_steps' parameter. The flaw is not triggered by normal, standard site usage; it specifically requires the attacker to interact with this administrative installation script, which performs insecure operations on the data it receives.

Is my server at risk if I run e107?

According to Halo Surface Signal, this vulnerability is likely internet-facing because the install.php component is often inadvertently left accessible after the initial setup. If your e107 instance is reachable from the internet, it is at higher risk. You should verify if the installer remains web-accessible on your systems, as this is a common point of exposure.

How should I respond to this threat advisory?

Prioritize identifying all servers running e107 within your environment. Once identified, verify if the software version is earlier than 2.3.7. If it is, the primary and necessary step is to update the application to version 2.3.7 or higher, which contains the fix for this issue, and ensure the installation script is no longer accessible.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.