CVE-2026-57859 e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()

e107 prior to version 2.3.8 contains a code execution vulnerability in the earray deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the userprefs column. The earray::unserialize function in...