Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

WookTeam ≤1.6.6 allows attackers to run code remotely

CVE-2026-88393 · published 13 days ago
Summary

The export function in WookTeam versions up to 1.6.6 processes a data input that can be crafted to make the server execute arbitrary code. An attacker who can call this API could take control of the server and access or modify all of your data. Upgrade to the latest WookTeam version or apply the vendor’s patch and restrict access to the export endpoint.

Original advisory text
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array() funct...
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array() function in app/Module/Base.php, which executes eval("\$array = $data;") whenever the decoded string starts with array. An attacker can inject arbitrary PHP code into the eval call and achieve RCE.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published5 Oct 2026
Updated15 Oct 2026
First seen5 Oct 2026
Sources
CVE-2026-88393 · NVD
CVE-2026-88393 · MITRE
Track software like this
Free during beta