CVE-2026-114407: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in e107inc e107

The e107 content management system before version 2.3.13 is vulnerable to reflected cross-site scripting due to improper neutralization of input during web page generation. Specifically, the author GET parameter in search.php is parsed with parse_str() and concatenated without escaping into an input tag's 'other' option key in the form handler. An attacker can craft a GET request that breaks out of the input tag context and injects an img element with an onerror JavaScript handler, leading to arbitrary script execution in the victim's browser session.

An unauthenticated attacker can execute arbitrary JavaScript in the context of the victim's browser session by exploiting this reflected XSS vulnerability. This can lead to session hijacking, defacement, or other client-side attacks. However, the vulnerability requires user interaction (clicking a crafted link) and does not allow direct system compromise.

A fix is available in e107 CMS version 2.3.13 and later. Users should upgrade to version 2.3.13 or newer to remediate this vulnerability. No vendor advisory content was provided, so patch status is based on the version range indicating fixed in 2.3.13. Until upgraded, avoid clicking untrusted links containing crafted author parameters.