Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

EGroupware can let attackers run any command on server

CVE-2026-27823 · published 3 months ago
Summary

In EGroupware, a flaw lets a logged‑in user run any command on the host computer, and if the system allows new users to sign up themselves, an attacker could do this without logging in. This could give full control of the server to the attacker. Update to the latest release (versions 26.2.20260224 or 23.1.20260224) to fix the problem.

What to do
  • Update egroupware egroupware to version 26.2.20260224.
  • Update egroupware egroupware to version 23.1.20260224.
  • Update egroupware egroupware/egroupware to version 26.2.20260224.
  • Update egroupware egroupware/egroupware to version 23.1.20260224.
Affected software
Ecosystem VendorProductAffected versions
composer egroupware egroupware >= 26.0.20251208, < 26.2.20260224
< 23.1.20260224
Fix: upgrade to 26.2.20260224
Packagist egroupware egroupware/egroupware >= 26.0.20251208, < 26.2.20260224
< 23.1.20260224
Fix: upgrade to 26.2.20260224
– egroupware egroupware <= 26.2.20260216
Original advisory text
EGroupware has a Remote Code Execution Vulnerability
A vulnerability has been identified in EGroupware that may lead to Remote Code Execution (RCE). The issue allows an authenticated attacker to execute arbitrary commands on the server. If user self-registration is enabled, the vulnerability may be exploitable without prior authentication. The vulnerability stems from improper authorization checks combined with a file write primitive and an arbitrary file read vulnerability, which together enable full system compromise. This has been patched in versions 26.2.20260224 and 23.1.20260224.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
CWE-94Code Injection
CWE-639Authorization Bypass Through User-Controlled Key
CWE-285Improper Authorization
Timeline
Published20 Jul 2026
Updated7 Nov 2026
First seen7 Jul 2026
Sources
GHSA-h9qx-v5xp-ph8p · GHSA
CVE-2026-27823 · NVD
GHSA-h9qx-v5xp-ph8p · OSV
CVE-2026-27823 · MITRE
Track software like this
Free during beta