CVE-2026-48997
HighCVSS 7.1Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
e107 is a content management system (CMS), versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In the resize_image() function, the source path is properly escaped, but the destination path is inserted inside raw double quotes, allowing an attacker to inject malicious code.
Risk Assessment
This vulnerability could lead to the execution of arbitrary system commands by an attacker, posing a serious threat to the security of the system and the organization's data. Exploitation of this vulnerability is only possible under specific configuration conditions.
Recommendation
It is recommended to upgrade to version 2.3.6, where this vulnerability has been fixed. Additionally, consider reviewing and restricting user permissions to minimize the risk of exploitation.
Other vulnerabilities in e107 CMS
See all- CVE-2022-50939High
Critical vulnerability in e107 CMS version 3.2.1 allows authenticated administrators to overwrite arbitrary server files via path traversal in the Media Manager's remote URL upload functionality (image.php). The upload_caption parameter is not properly sanitized, enabling directory traversal sequences like ../../../ to overwrite files outside the intended directory. This can lead to complete compromise of the web application.
- CVE-2022-50916High
CVE-2022-50916 affects e107 CMS version 3.2.1. The vulnerability is a file upload flaw in the Media Manager import functionality that allows authenticated administrators to overwrite server files, such as top.php in the web application directory.
- CVE-2022-50907High
CVE-2022-50907 affects e107 CMS version 3.2.1. The vulnerability allows authenticated administrative users to bypass upload restrictions and execute PHP files by manipulating the upload URL parameter in the Media Manager import feature. This enables remote code execution on the server.
- CVE-2022-50905Critical
e107 CMS version 3.2.1 contains multiple vulnerabilities allowing XSS attacks. The first is a reflected XSS in the news comment functionality, where an authenticated user can inject malicious JavaScript via a URL parameter. The second is an upload restriction bypass for admins, allowing SVG files with malicious code to be uploaded via the media manager's remote URL feature, leading to stored XSS.
- CVE-2026-46620Medium
CSRF vulnerability in e107 CMS before version 2.3.5. The CSRF token validation is skipped if no token is present in the request.
- CVE-2021-47937High
e107 CMS 2.3.0 allows authenticated users with theme installation permissions to execute arbitrary code by uploading a malicious theme file. Attackers can upload a crafted theme package via the theme.php endpoint that deploys a web shell to the e107_themes directory, then execute system commands via the payload.php script.
Original NVD description (English source)
e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In resize_image(), the source path is escaped with escapeshellarg(), but the destination path is inserted inside raw double quotes in the convert command; in the submit-news upload flow, that destination filename includes the first six characters of user-controlled news title input. Because the title filter removes literal spaces but not tab characters, and shell expansions such as $(...) and backticks can survive into the quoted destination argument, /bin/sh -c may evaluate attacker-controlled input. Exploitation is possible only when all of the following non-default settings are enabled: resize_method=ImageMagick, subnews_attach=1, upload_enabled=1, subnews_resize is numeric between 30 and 5000, and the attacker is a non-admin in classes permitted by both subnews_class and upload_class. This issue has been fixed in version 2.3.6.