CVE-2026-48997: e107: Command Injection via shell expansion in ImageMagick resize destination path

Synopsis

A command injection vulnerability in e107, a PHP-based content management system, allows an authenticated low-privilege user to execute arbitrary shell commands on the server through a crafted news title. The attack is reachable over the network but requires a low-privilege account and a specific combination of non-default site configuration settings to be active simultaneously. Successful exploitation gives an attacker partial read access to the server, full write capability, and the ability to crash or disrupt the affected service. A patched-image rebuild at version 2.3.6 is available on HarborGuard for environments running an affected version of e107.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the e107 web application over the network; no local or physical access is needed.

• AuthenticationRequired

  A low-privilege account that has been granted access via subnews_class and upload_class is required; anonymous access is not sufficient.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed; the attacker submits a crafted news title directly.

• Attack complexityDetail

  Exploitation depends on a specific combination of five non-default configuration settings all being active at the same time, making reliable exploitation environmentally conditional rather than condition-free.

Blast Radius

• An attacker can execute arbitrary shell commands under the web server process, enabling reads of files and secrets accessible to that process such as database credentials and session tokens.
• An attacker can write or overwrite files on the server filesystem with the permissions of the web server user, allowing webshell placement or content tampering.
• An attacker can terminate or destabilize the affected service, causing a denial of service for site visitors.