e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database wri…

e107 versions prior to 2.3.8 are vulnerable to a second-order code execution flaw in the e_array deserialization handler. The e_array::unserialize() function in e107_handlers/core_functions.php performs only a superficial prefix check for the string 'array' before passing stored database values directly to eval(). An attacker with out-of-band write access to the database can store a crafted payload in the user_prefs column, which is then automatically executed as PHP code when the affected user's preferences are loaded via e_user_pref::load(). This constitutes a second-order (stored) code execution vulnerability, as exploitation requires prior database access rather than direct user input. The flaw is patched in e107 version 2.3.8, with the fix available in the referenced GitHub commit. The vulnerability is tracked as CVE-2026-57859 and has been assigned a high criticality rating.