e107 CMS v3.2.1 - Reflected XSS via Comment Flow
Published Jan 13, 2026 · Updated Oct 23, 2026
Original summary
Normalized public record · Updated Oct 23, 2026
e107 CMS v3.2.1 - Reflected XSS via Comment Flow
Publisher and source text is retained separately from QFinch interpretation.
QFinch assessment
e107 CMS version 3.2.1 contains multiple vulnerabilities that allow cross-site scripting (XSS) attacks. The first vulnerability is a reflected XSS that occurs in the news comment functionality when authenticated users interact with the comment form. An attacker can inject malicious JavaScript code through the URL parameter that gets executed when users click outside the comment field after typing content. The second vulnerability involves an upload restriction bypass for authenticated administrators, allowing them to upload SVG files containing malicious code through the media manager's remote URL upload feature. This results in stored XSS when the uploaded SVG files are accessed. These vulnerabilities were discovered by Hubert Wojciechowski and affect the news.php and image.php components of the CMS.
Evidence: public source recordsAffected products
| Affected package, product or range | Fix status |
|---|---|
| Consult the referenced vendor advisory for affected versions. | Consult source advisory |
Matching a version is only one part of assessing exposure. QFinch has not assessed your environment on this public page.
Remediation
Apply the vendor-supported fixed release or mitigation, then verify the affected component is no longer reachable.
- Confirm the affected product and reachable code path exist in your environment.
- Apply the vendor-supported patch or mitigation from the primary advisory.
- Rescan the exact deployed revision and retain verification evidence.
Evidence coverage
- SSVC priority
- MEDIUM
- Confidence
- 20%
- Aliases
- None reported
Scores appear only when corresponding evidence exists. Missing data is never interpreted as zero risk.
Sources and record history
- ExploitDB-50910 ↗
- Official Vendor Homepage ↗
- Software Download Page ↗
- VulnCheck Advisory: e107 CMS v3.2.1 - Reflected XSS via Comment Flow ↗
Record history
Published Jan 13, 2026 · Last refreshed Oct 23, 2026