e107 CMS versions 2.3.5 and earlier contain a command‑injection flaw in the ImageMagick image‑resize routine. The source file path is escaped, but the destination file path is inserted directly inside double quotes in an unfiltered shell command. The destination filename is derived from the first six characters of a user‑controlled news title; because the title filter removes spaces but not tabs, shell expansion sequences such as $(…) or backticks can survive and be interpreted by /bin/sh in the convert command. This allows an attacker to execute arbitrary OS commands through the web interface.

All e107 CMS installations from e107 Inc running version 2.3.5 or older that are configured with resize_method set to ImageMagick, subnews_attach enabled, upload_enabled enabled, subnews_resize set to a numeric value between 30 and 5000, and where the attacker belongs to user classes allowed by both subnews_class and upload_class. The vulnerability is mitigated in version 2.3.6 and later.

The vulnerability has a CVSS score of 7.1, indicating medium‑high impact. The EPSS score of less than 1% suggests that exploitation is currently rare, and the issue is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be remote via the public web interface and can grant remote code execution to a non‑admin user, providing a powerful foothold for further compromise. System owners should treat this as a high‑priority risk if the vulnerable upload and resize features are active.