CVE-2026-48997

e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In resize_image(), the source path is escaped with escapeshellarg(), but the destination path is inserted inside raw double quotes in the convert command; in the submit-news upload flow, that destination filename includes the first six characters of user-controlled news title input. Because the title filter removes literal spaces but not tab characters, and shell expansions such as $(...) and backticks can survive into the quoted destination argument, /bin/sh -c may evaluate attacker-controlled input. Exploitation is possible only when all of the following non-default settings are enabled: resize_method=ImageMagick, subnews_attach=1, upload_enabled=1, subnews_resize is numeric between 30 and 5000, and the attacker is a non-admin in classes permitted by both subnews_class and upload_class. This issue has been fixed in version 2.3.6.

• CWE-78

• https://github.com/e107inc/e107/releases/tag/v2.3.6
• https://github.com/e107inc/e107/security/advisories/GHSA-3j33-c9v4-4p42
• https://github.com/e107inc/e107/security/advisories/GHSA-3j33-c9v4-4p42

Published

Jun 17, 2026

Last Modified

Jun 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48989Windows-MCP is an open-source project that integrates AI age…8.9
• CVE-2026-4899A security flaw has been discovered in code-projects Online …2.4
• CVE-2026-48990joserfc is a Python library that provides an implementation …5.3
• CVE-2026-48991XianYuLauncher is a Minecraft Java Edition launcher. In vers…5.5
• CVE-2026-48994ImageMagick is free and open-source software used for editin…5.9
• CVE-2026-48995pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a ma…7.5
• CVE-2026-48998guzzlehttp/psr7 is a PSR-7 HTTP message library implementati…5.3
• CVE-2026-48999Attackers carefully craft malicious scripts, such as JavaScr…5.7
• CVE-2026-4900A weakness has been identified in code-projects Online Food …5.5
• CVE-2026-49000An insecure password scheme refers to vulnerabilities arisin…7
• CVE-2026-49001Cross-site request forgery (CSRF) vulnerabilities allow atta…5.3
• CVE-2026-49002Access control failure means that an application does not ef…9.1