CVE-2026-48997
- Source
- https://cve.org/CVERecord?id=CVE-2026-48997
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48997.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-48997
- Aliases
-
- GHSA-3j33-c9v4-4p42
- Published
- 2026-06-17T21:42:59.679Z
- Modified
- 2026-07-15T01:49:11.834972747Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H CVSS Calculator
- Summary
- e107: Command Injection via shell expansion in ImageMagick resize destination path
- Details
-
e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In resizeimage(), the source path is escaped with escapeshellarg(), but the destination path is inserted inside raw double quotes in the convert command; in the submit-news upload flow, that destination filename includes the first six characters of user-controlled news title input. Because the title filter removes literal spaces but not tab characters, and shell expansions such as $(...) and backticks can survive into the quoted destination argument, /bin/sh -c may evaluate attacker-controlled input. Exploitation is possible only when all of the following non-default settings are enabled: resizemethod=ImageMagick, subnewsattach=1, uploadenabled=1, subnewsresize is numeric between 30 and 5000, and the attacker is a non-admin in classes permitted by both subnewsclass and upload_class. This issue has been fixed in version 2.3.6.
- Database specific
{ "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48997.json", "cwe_ids": [ "CWE-78" ] }- References