CVE-2026-40187

Summary

In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (.xet) to the VFS /etemplates mount. The Widget::expand_name() method passes template widget attribute values directly into a PHP eval() call with only double-quote escaping applied - backtick characters are not escaped. In PHP, backticks inside a double-quoted eval() string execute shell commands. This allows an admin-level user to escalate from web application access to arbitrary OS command execution on the server.

Affected Software

Weaknesses

• CWE-78: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• CWE-95: CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: total

Additional References

• https://github.com/EGroupware/egroupware/security/advisories/GHSA-8737-2x9g-xjj7

References

• https://github.com/EGroupware/egroupware/security/advisories/GHSA-8737-2x9g-xjj7

• ←Previous
• Next→