CVE-2026-57859 is a code execution vulnerability in e107 prior to version 2.3.8. The issue exists in the e_array::unserialize() function within e107_handlers/core_functions.php, which performs only a prefix check for the string 'array' before passing the stored value to eval(). An attacker who can write arbitrary data to the user_prefs column in the database can craft a payload that leads to arbitrary PHP code execution when e_user_pref::load() materializes the preferences. This vulnerability requires out-of-band database write access and local privileges to the application context to trigger.

Successful exploitation allows an attacker with limited privileges (out-of-band database write access) to execute arbitrary PHP code within the context of the e107 application. This can lead to full compromise of the affected system, including data theft, manipulation, or further system compromise. The CVSS 4.0 score is 7.7 (high severity), reflecting the significant impact and the complexity of the attack vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict database write access to trusted users only and monitor for unauthorized modifications to the user_prefs column. Avoid loading untrusted user preferences and consider disabling or modifying the vulnerable deserialization functionality if possible.