Is CVE-2026-48997 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48997 being exploited in the wild.

How severe is CVE-2026-48997?

High severity, with a CVSS score of 7.1, published 17 June 2026.

Is there a fix for CVE-2026-48997?

A patch was published on 2026-05-24: Version 2.3.6 released to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48997 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-48997?

Check whether you run E107inc E107 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48997: e107 CMS command injection in ImageMagick resize destination path

CVE-2026-48997 · Severity: high · CVSS 7.1 · Published 2026-06-17

e107 is a content management system used to build and manage websites. A security flaw in its image processing component allows an attacker to execute unauthorized system commands on the web server. If exploited, this could lead to the theft of sensitive data, full server takeover, or the deletion of critical website files, causing a complete service outage. This attack requires specific non-default settings to be enabled and the attacker to have basic user-level access to submit news content.

Technologies: E107inc E107. Vendors: E107inc.

Quick answers

Is CVE-2026-48997 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48997 being exploited in the wild.
How severe is CVE-2026-48997?: High severity, with a CVSS score of 7.1, published 17 June 2026.
Which products and versions are affected?: E107inc E107 <= 2.3.5.
Is there a fix for CVE-2026-48997?: A patch was published on 2026-05-24: Version 2.3.6 released to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48997 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48997?: Check whether you run E107inc E107 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in the `resize_image()` function within `e107_handlers/resize_handler.php`. While the source file path is properly escaped using `escapeshellarg()`, the destination path is interpolated into an ImageMagick `convert` command string using only raw double quotes. In the `submit-news` workflow, the destination filename is derived from the first six characters of the user-provided news title. Because the title filter fails to strip shell expansion characters (like `$()`, backticks, or globs) and only neutralizes literal spaces (allowing tab characters to act as IFS separators), an attacker can inject shell commands. Successful exploitation requires `resize_method` set to 'ImageMagick', news attachments and uploads enabled, and a valid numeric `subnews_resize` value. The issue is fixed in version 2.3.6.

Affected products

e107inc e107 <= 2.3.5

Timeline

2026-05-24: patched: Version 2.3.6 released to address the vulnerability.
2026-06-17: disclosed: CVE-2026-48997 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.