The e107 content management system (CMS) versions 2.3.5 and earlier contain an OS command injection vulnerability (CWE-78) in the ImageMagick resize functionality. Specifically, in the resize_image() function, the source path is escaped properly, but the destination path is inserted inside raw double quotes in the convert command. The destination filename includes the first six characters of user-controlled news title input, which can contain tab characters and shell expansions like $(...) or backticks that survive the quoting. This allows /bin/sh -c to evaluate attacker-controlled input, leading to command injection. Exploitation is only possible when multiple non-default settings are enabled (resize_method=ImageMagick, subnews_attach=1, upload_enabled=1, subnews_resize numeric between 30 and 5000) and the attacker is a non-admin user permitted by subnews_class and upload_class. The vulnerability is fixed in version 2.3.6.

Successful exploitation can lead to arbitrary command execution on the server with the privileges of the web application process. The CVSS 3.1 score is 7.1 (high), reflecting low attack complexity but requiring specific configuration and privileges. The impact includes potential confidentiality loss, integrity compromise, and availability disruption due to command injection.

Upgrade to e107 version 2.3.6 or later, where this vulnerability is fixed. There is no official patch or temporary fix mentioned other than upgrading. Until upgraded, ensure the vulnerable configuration settings (resize_method=ImageMagick, subnews_attach=1, upload_enabled=1, subnews_resize between 30 and 5000) are not all enabled simultaneously, or restrict non-admin user permissions to prevent exploitation.