CVE-2026-48997: e107 CMS Command Injection via ImageMagick Resize Destination Path

Technical summary

The vulnerability resides in the resize_image() function within e107's image processing workflow. While the source path is properly escaped using escapeshellarg(), the destination path is constructed by inserting user-controlled input directly into double-quoted arguments of a shell convert command invocation. In the news submission flow, the destination filename incorporates the first six characters of the news title parameter. The input validation removes literal space characters but does not strip or escape tab characters or shell expansion sequences such as $(...) and backticks. When these survive into the quoted destination argument, /bin/sh -c will evaluate them as code. Exploitation requires: resize_method set to 'ImageMagick', subnews_attach enabled, upload_enabled active, subnews_resize set to a numeric value between 30 and 5000 pixels, and the attacker possessing a user account in a class permitted by both subnews_class and upload_class permissions. Admin accounts are not affected.

Business impact

Successful exploitation could allow an attacker to execute arbitrary commands with the privileges of the web server process, potentially leading to data theft, unauthorized modification of content, installation of malware, or lateral movement within the network. Given the prevalence of e107 in small and medium-sized business websites, a widespread deployment could result in coordinated defacement or data loss. The impact is heightened because compromised servers may serve as pivot points for supply-chain attacks or further infrastructure compromise.

Affected systems

e107 CMS version 2.3.5 and all earlier versions are affected. Exploitation requires a non-administrative user account and specific server configuration: ImageMagick must be the configured image resize method (not the default GD library), the news module must permit file attachments (subnews_attach enabled), uploads must be globally enabled (upload_enabled active), the subnews_resize dimension setting must be a numeric value between 30 and 5000 pixels, and the attacker must be in a user class authorized by both subnews_class and upload_class permissions. Systems using the default GD-based image resizing, those without news attachments enabled, or those restricting upload permissions to admin-only are not vulnerable.

Exploitability

While exploitation requires authentication and several non-default configuration flags to be enabled simultaneously, the barrier to entry is moderate rather than high. Any valid user account (even with limited permissions) can attempt exploitation if their class membership intersects the configured subnews_class and upload_class restrictions. The attack vector is straightforward: inject shell metacharacters into the news title field during article submission. The complexity derives from the conjunction of prerequisite settings, which may be less common in default installations but are often enabled on sites requiring robust image handling and community content submission. Organizations running multi-user e107 installations with contributor workflows face elevated risk.

Remediation

Upgrade to e107 version 2.3.6 or later, which addresses the destination path escaping issue. If immediate patching is not feasible, disable one or more of the prerequisite settings: set resize_method to the default GD library instead of ImageMagick, disable subnews_attach to prevent file uploads with news submissions, set upload_enabled to false, or restrict subnews_class and upload_class permissions to administrators only. Additionally, implement strict input validation or filtering on the news title field to reject shell metacharacters and tab characters at the application level.

Patch guidance

e107 version 2.3.6 or later contains the fix. Administrators should verify their current version via the admin panel or by checking the version constant in e107_config.php. Test the upgrade in a staging environment first, particularly if the site uses custom plugins or themes that may interact with image processing. No configuration changes are required after patching; the fix applies automatically.

Detection guidance

Monitor web server logs and application logs for unusual image processing activity, particularly convert command invocations with unexpected characters or patterns in filenames. Intrusion detection systems can alert on payloads containing backticks, $(...), or other shell metacharacters in HTTP parameters, especially those submitted to news submission endpoints. Search uploaded images or temporary directories for files with suspicious names containing shell syntax. Review authentication logs for new low-privilege accounts created around the time of a potential breach, as attackers typically establish persistence through dedicated accounts.

Why prioritize this

This vulnerability merits prompt attention because it enables unauthenticated code execution on affected systems via a relatively accessible attack surface (user-submitted content). Although exploitation depends on multiple non-default settings, the aggregate prevalence of e107 and the likelihood that some installations enable community-contributed content and robust image processing creates meaningful risk. The CVSS 3.1 score of 7.1 (HIGH) reflects high impact on confidentiality and integrity, moderate access complexity, and the requirement for local authentication. Organizations running community-driven e107 sites should prioritize patching.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects: Network attack vector (AV:N), allowing remote exploitation; High access complexity (AC:H) due to the requirement for multiple non-default configuration flags to be present simultaneously; Low privilege requirement (PR:L) because any authenticated user in the correct classes can attempt the attack; No user interaction needed (UI:N); and significant impact: Low confidentiality (C:L), High integrity (I:H), and High availability (A:H) if the attacker leverages code execution to modify content or disable services. The score does not fall to CRITICAL because the AC:H factor substantially constrains the real-world attack surface, and exploitation is limited to installations that have explicitly enabled ImageMagick resizing and community uploads.

Frequently asked questions