e107 versions prior to 2.3.8 contain a critical code execution vulnerability in the e_array deserialization handler. An attacker with out-of-band database write access can store a crafted payload in the user_prefs column to execute arbitrary PHP code. The vulnerable function e_array::unserialize() in e107_handlers/core_functions.php only checks for an 'array' string prefix before passing the stored value directly to eval(). This insecure deserialization pattern triggers automatic PHP execution whenever the affected user's preferences are loaded via e_user_pref::load(). The vulnerability is classified as a second-order code execution flaw, requiring prior database access as a precondition. A fix was introduced in e107 version 2.3.8 via a documented commit. The issue is tracked under CVE-2026-57859 and has been assigned a high criticality rating.