CVE-2026-57859 is a code execution vulnerability in e107 prior to version 2.3.8. The flaw exists in the e_array::unserialize() function within e107_handlers/core_functions.php, which performs an insufficient check by only verifying that the serialized string starts with 'array' before passing it to PHP's eval() function. This allows an attacker who has out-of-band write access to the database to inject a malicious payload into the user_prefs column. When the affected user's preferences are loaded via e_user_pref::load(), the malicious payload is executed as PHP code, resulting in arbitrary code execution.

An attacker with out-of-band database write access can execute arbitrary PHP code on the affected system. This can lead to full compromise of the application environment, including unauthorized actions and potential system control. The vulnerability requires the attacker to have database write capabilities outside the normal application flow, which may limit exploitability depending on the environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict database write access to trusted users only and monitor for unauthorized modifications to the user_prefs column. Avoid loading untrusted serialized data. Follow vendor updates closely for an official patch or mitigation.