Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

EGroupware admins can run any command on server

CVE-2026-40187 · published 3 months ago
Summary

In EGroupware 26.0 and earlier, an administrator who can upload template files can place a specially crafted file that causes the system to execute operating‑system commands. This lets the admin move from using the web interface to controlling the underlying server. Upgrade to a newer version or restrict template uploads to trusted users to eliminate the risk.

What to do
  • Update egroupware egroupware to version 26.4.20260413.
  • Update egroupware egroupware to version 23.1.20260601.
  • Update egroupware egroupware/egroupware to version 26.4.20260413.
  • Update egroupware egroupware/egroupware to version 23.1.20260601.
Affected software
Ecosystem VendorProductAffected versions
composer egroupware egroupware >= 26.0.20251208, < 26.0.20260113
< 23.1.20260601
Fix: upgrade to 26.4.20260413
Packagist egroupware egroupware/egroupware >= 26.0.20251208, < 26.4.20260413
< 23.1.20260601
Fix: upgrade to 26.4.20260413
– egroupware egroupware <= 26.0
Original advisory text
EGroupware has Authenticated RCE via Malicious eTemplate Upload
In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (`.xet`) to the VFS `/etemplates` mount. The `Widget::expand_name()` method passes template widget attribute values directly into a PHP `eval()` call with only double-quote escaping applied - **backtick characters are not escaped**. In PHP, backticks inside a double-quoted `eval()` string execute shell commands. This allows an admin-level user to escalate from web application access to arbitrary OS command execution on the server.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-78OS Command Injection
CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Timeline
Published20 Jul 2026
Updated6 Nov 2026
First seen7 Jul 2026
Sources
GHSA-8737-2x9g-xjj7 · GHSA
CVE-2026-40187 · NVD
GHSA-8737-2x9g-xjj7 · OSV
CVE-2026-40187 · MITRE
Track software like this
Free during beta