Language: PHP
Label: vulnerable
CWE: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Code:
    private function convert2pdf($file,$cacheFile,$ext){
		$command = $this->getSoffice();
		if(!$command){
			Action($this->pluginName)->showTips(LNG('officeViewer.libreOffice.sofficeError'), 'LibreOffice');
		}
		//linux下$cacheFile不可写问题，先生成到/tmp下;再复制出来
		$tempPath = $cacheFile;
		if($GLOBALS['config']['systemOS'] == 'linux' && is_writable('/tmp/')){
			mk_dir('/tmp/libreOffice');
			$tempPath = '/tmp/libreOffice/'.rand_string(15).'.pdf';
		}
        $fname = get_path_this($tempPath);
        $fpath = get_path_father($tempPath);
        // 转换类型'pdf'改为'新文件名.pdf'，会生成'源文件名.新文件名.pdf'
		$export = 'export HOME=/tmp/libreOffice && ';
        $script = $export.$command . ' --headless --invisible --convert-to '.$fname.' "'.$file.'" --outdir '.$fpath;
		$out = shell_exec($script);

        $tname = substr(end(explode('/', $file)), 0, -strlen('.'.$ext));
        $tfile = $fpath . $tname . '.' . $fname;    // 源文件名.filename.pdf
        if(!file_exists($tfile)){
            write_log('libreoffice convert error: '.$script."\n".$out,'error');
        }
		$res = move_path($tfile,$cacheFile);
		if (!$res) write_log('libreoffice move file error: '.$tfile.'=>'.$cacheFile, 'error');
	}