Description

e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise. This issue is fixed in version 2.3.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T18:17:38.013Z",
  "pubdate": "2026-10-14T18:17:38.013Z",
  "executiveSummary": "e107 versions prior to 2.3.7 are susceptible to a critical PHP object injection vulnerability within the install.php file. The flaw arises from the insecure processing of the attacker-controlled 'previous_steps' POST parameter, which is passed to the unserialize() function without any class allow-listing or sanitization.\nThis vulnerability enables an unauthenticated remote attacker to achieve arbitrary code execution on the underlying server. By supplying a maliciously crafted serialized object graph, an attacker can manipulate the application's internal state. When the application interacts with specific gadget chains—specifically utilizing the 'GuzzleHttp\\Psr7\\PumpStream' class—it facilitates the trigger of arbitrary PHP functions.\nBecause the installer remains accessible post-installation, the attack vector is exposed to unauthenticated users via the network. Successful exploitation results in complete server compromise, allowing the attacker to execute arbitrary commands with the privileges of the web server process. This poses a severe risk to confidentiality, integrity, and availability, necessitating an immediate upgrade to version 2.3.7 or higher.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of PHP's unserialize() function in the install.php file of the e107 CMS. The application accepts a POST parameter named 'previous_steps' from an unauthenticated user and processes it through unserialize() at the file scope and again within the 'e_install' constructor. The lack of an 'allowed_classes' option during the deserialization process allows for the instantiation of arbitrary classes present in the environment's scope.\nExploitation leverages a POP (Property Oriented Programming) chain, utilizing the 'GuzzleHttp\\Psr7\\PumpStream' class bundled with the CMS. The exploit involves crafting a serialized object graph that controls the 'paths.hash' property. During the lifecycle of the object, this property is assigned to 'site_path'. When the application performs operations that force string coercion on the manipulated 'site_path' variable, the underlying magic methods within the stream wrapper are triggered.\nThe attack flow proceeds as follows: 1) The attacker reaches the publicly accessible install.php script, which does not require authentication or evidence of a non-configured state. 2) The attacker sends a POST request containing a maliciously crafted serialized PHP object assigned to the 'previous_steps' parameter. 3) The 'unserialize()' function processes the input, instantiating the 'GuzzleHttp\\Psr7\\PumpStream' gadget. 4) The object graph is processed such that the 'paths.hash' property is coerced into a string. 5) This coercion invokes an attacker-controlled callable (callback) hidden within the gadget chain. 6) The final payload is executed with the context and privileges of the web server user.\nThis vulnerability is particularly dangerous because it bypasses standard application-layer security controls. The ability to reach the installer on a production site ensures that even fully deployed instances remain vulnerable. Post-exploitation impact includes the potential for persistent backdoors, full data exfiltration, and lateral movement within the hosting infrastructure. The vulnerability is confirmed to exist in all versions of e107 prior to 2.3.7."
}