What is the CVSS score of CVE-2026-48997?

CVE-2026-48997 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of e107 CMS are affected by CVE-2026-48997?

e107 CMS versions 2.3.5 and earlier contain a vulnerability allowing authenticated users to execute arbitrary system commands with web server privileges through the news submission feature.

How to fix or mitigate CVE-2026-48997?

Within 24 hours: Identify all e107 CMS deployments and document versions; disable news submission permissions for all non-administrator accounts; review access logs for unexpected news submission activity. Within 7 days: Deploy WAF rules blocking shell metacharacters in form inputs; contact e107 project for patch availability and timeline. Within 30 days: Apply vendor-released patch immediately upon availability, or implement permanent mitigation by disabling the upload feature and implementing granular execution monitoring for the web server process.

e107 CMS CVE-2026-48997

HIGH

OS Command Injection (CWE-78)

2026-06-17 GitHub_M

Command Injection E107 E107Inc

7.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable via news submission (AV:N); five non-default prefs plus class membership justify AC:H; requires authenticated non-admin (PR:L); shell RCE as web user yields full CIA impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 22:18 vuln.today

Analysis Generated

Jun 17, 2026 - 22:18 vuln.today

DescriptionCVE.org

e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In resize_image(), the source path is escaped with escapeshellarg(), but the destination path is inserted inside raw double quotes in the convert command; in the submit-news upload flow, that destination filename includes the first six characters of user-controlled news title input. Because the title filter removes literal spaces but not tab characters, and shell expansions such as $(...) and backticks can survive into the quoted destination argument, /bin/sh -c may evaluate attacker-controlled input. Exploitation is possible only when all of the following non-default settings are enabled: resize_method=ImageMagick, subnews_attach=1, upload_enabled=1, subnews_resize is numeric between 30 and 5000, and the attacker is a non-admin in classes permitted by both subnews_class and upload_class. This issue has been fixed in version 2.3.6.

AnalysisAI

Command injection in e107 CMS versions 2.3.5 and earlier allows authenticated low-privilege users to execute arbitrary shell commands as the web server user via the news submission upload flow. The flaw lives in resize_image() where the ImageMagick convert destination path embeds a 6-character slice of the user-controlled news title without shell escaping, letting tab characters and $(...) / backtick expansions reach /bin/sh -c. No public exploit identified at time of analysis, and exploitation requires a specific non-default configuration combination.

Technical ContextAI

e107 is an open-source PHP content management system. The vulnerable code path is resize_image() in the media-handling subsystem, which builds an ImageMagick 'convert' command line. While the source path is sanitized via PHP's escapeshellarg(), the destination filename - which incorporates the first six characters of the submitted news title - is interpolated inside raw double quotes. The CMS title filter strips literal space characters but leaves tab (\t) intact, so an attacker can break tokenization inside the quoted string and inject shell metacharacters such as $(cmd) or cmd, which /bin/sh -c expands before convert is invoked. This is a classic CWE-78 OS Command Injection rooted in inconsistent argument escaping (escapeshellarg on one operand, manual quoting on another). The affected CPE is cpe:2.3:a:e107inc:e107:*:*:*:*:*:*:*:* for all 2.x branches up to and including 2.3.5.

RemediationAI

Vendor-released patch: e107 v2.3.6 - upgrade from any 2.x release at or below 2.3.5 via https://github.com/e107inc/e107/releases/tag/v2.3.6 (commit 794a179f hardens the convert destination path). If immediate upgrade is not possible, neutralize the attack surface by changing any one of the gating preferences: set resize_method to GD instead of ImageMagick, set subnews_attach=0 to disable image attachments on news submission, set upload_enabled=0 to disable user uploads (this also blocks legitimate reader uploads site-wide), set subnews_resize outside the 30-5000 numeric range, or tighten subnews_class / upload_class so only trusted admins can submit news with attachments (side effect: removes the reader-news contribution workflow). Consult the full advisory at https://github.com/e107inc/e107/security/advisories/GHSA-3j33-c9v4-4p42 before deploying workarounds.