PT-2026-114217

e107 is a content management system CMS. Prior to 2.3.7, install.php decodes the attacker-controlled previous steps POST parameter and passes it to unserialize at file scope and again in the e install constructor without restricting allowed classes. The installer remains accessible after a normal...