Executive brief
e107 is a content management system used to build and manage websites. A security flaw in its image processing component allows an attacker to execute unauthorized system commands on the web server. If exploited, this could lead to the theft of sensitive data, full server takeover, or the deletion of critical website files, causing a complete service outage. This attack requires specific non-default settings to be enabled and the attacker to have basic user-level access to submit news content.
Technical details
An OS command injection vulnerability exists in the `resize_image()` function within `e107_handlers/resize_handler.php`. While the source file path is properly escaped using `escapeshellarg()`, the destination path is interpolated into an ImageMagick `convert` command string using only raw double quotes. In the `submit-news` workflow, the destination filename is derived from the first six characters of the user-provided news title. Because the title filter fails to strip shell expansion characters (like `$()`, backticks, or globs) and only neutralizes literal spaces (allowing tab characters to act as IFS separators), an attacker can inject shell commands. Successful exploitation requires `resize_method` set to 'ImageMagick', news attachments and uploads enabled, and a valid numeric `subnews_resize` value. The issue is fixed in version 2.3.6.
Affected products
- e107inc e107 <= 2.3.5
Timeline
- 2026-05-24: patched: Version 2.3.6 released to address the vulnerability.
- 2026-06-17: disclosed: CVE-2026-48997 published.