e107 is a CMS that, before version 2.3.7, processes a user‑supplied POST parameter named previous_steps in install.php and passes it to unserialize() without restricting the classes that may be instantiated. By crafting a serialized object graph that includes GuzzleHttp\\Psr7\\PumpStream, the attacker can influence the paths.hash field to override site_path, which then triggers a string conversion that calls an attacker‑controlled callable. An unauthenticated attacker who can reach install.php can exploit this flaw to execute arbitrary PHP functions with the web‑server’s privileges, leading to complete compromise of the host.

The vulnerable component is e107 CMS (e107inc:e107). All releases prior to 2.3.7 are affected; the fix was released with the 2.3.7 release. No other vendors or products are reported to be impacted.

The flaw carries a CVSS score of 9.8, indicating critical severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need only unauthenticated access to the install.php page, which typically remains accessible after installation, to execute the exploit. If this file is still reachable, the attacker can achieve remote code execution with the privileges of the web‑server process.