PatchTheCVECVE-2025-61505: e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script
CVE-2025-61505 is a medium-severity flaw (CVSS 6.5) affecting e107. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script. The script processes user-controlled input in the `previous_steps` POST parameter using `unserialize(base64_decode())` without validation, allowing attackers to craft malicious serialized data. This could lead to remote code execution, arbitrary file operations, or denial of service, depending on available PHP object gadgets in the codebase.
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 71%) |
| CISA exploited list | No |
| Weakness | CWE-502 |
| Published | 2025-10-10 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-61505?
e107: upgrade to newer than 2.3.3. Exact commands for each OS are on this page.
Is CVE-2025-61505 being exploited?
CVE-2025-61505 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-61505 affect?
CVE-2025-61505 affects e107. Severity is medium (CVSS 6.5). e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script. The script processes user-controlled input in the `previous_steps` POST parameter using `unserialize(base64_decode())` without validation, allowing
How urgent is CVE-2025-61505?
Priority 35/100. Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2025-11941 MEDIUM 5.4 UPGRADE A vulnerability was detected in e107 CMS up to 2.3.3
- CVE-2022-50939 HIGH 7.2 DOWNGRADE e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators
- CVE-2022-50916 HIGH 7.2 DOWNGRADE e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrators to overri
- CVE-2022-50907 HIGH 7.2 DOWNGRADE e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to
- CVE-2022-50906 MEDIUM 4.8 DOWNGRADE e107 CMS 3.2.1 contains an upload restriction bypass vulnerability that allows authenticated administrators to