Read the docs
TI-2026-17853 Aliases CVE-2026-22243GHSA-rvxj-7f72-mhrx

EGroupware has SQL Injection in Nextmatch Filter Processing

Priority HIGH 73CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

EGroupware is a Web based groupware server written in PHP. A SQL Injection vulnerability exists in the core components of EGroupware prior to versions 23.1.20260113 and 26.0.20260113, specifically in the `Nextmatch` filter processing. The flaw allows authenticated attackers to inject arbitrary SQL commands into the `WHERE` clause of database queries. This is achieved by exploiting a PHP type juggling issue where JSON decoding converts numeric strings into integers, bypassing the `is_int()` security check used by the application. Versions 23.1.20260113 and 26.0.20260113 patch the vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00428 37th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed egroupware (EGroupware): 23.1.20260113, 26.0.20260113egroupware/egroupware (Packagist): 23.1.20260113, 26.0.20260113

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EGroupwareegroupwarebefore 23.1.20260113; before 26.0.2026011323.1.20260113, 26.0.20260113Patch availableCNA
—egroupware/egroupware (Packagist)before 23.1.2026011323.1.20260113Patch availableGHSA-rvxj-7f72-mhrx
—egroupware/egroupware (Packagist)26.0.20251208 to before 26.0.2026011326.0.20260113Patch availableGHSA-rvxj-7f72-mhrx
  • egroupware VendorEGroupware Affected before 23.1.20260113; before 26.0.20260113 Fixed in 23.1.20260113, 26.0.20260113 Patch available CNA
  • egroupware/egroupware (Packagist) Vendor— Affected before 23.1.20260113 Fixed in 23.1.20260113 Patch available GHSA-rvxj-7f72-mhrx
  • egroupware/egroupware (Packagist) Vendor— Affected 26.0.20251208 to before 26.0.20260113 Fixed in 26.0.20260113 Patch available GHSA-rvxj-7f72-mhrx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:egroupware:egroupware:*:*:*:*:community:*:*:*before 23.1.20260113; 26.0.20251208 to before 26.0.20260113VulnerableEGroupware
  • cpe:2.3:a:egroupware:egroupware:*:*:*:*:community:*:*:* Versions before 23.1.20260113; 26.0.20251208 to before 26.0.20260113 Vulnerable ·EGroupware

Remediation

  • Fix · CNA egroupware (EGroupware) Fixed in 23.1.20260113, 26.0.20260113
  • Fix · GHSA-rvxj-7f72-mhrx egroupware/egroupware (Packagist) Fixed in 23.1.20260113 Advisory →
  • Fix · GHSA-rvxj-7f72-mhrx egroupware/egroupware (Packagist) Fixed in 26.0.20260113 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22243
  2. 2026-10-03 Alias added: GHSA-rvxj-7f72-mhrx

References

Exploit 1

Advisory 1

Other 3

  • TI-2024-27031 EGroupware before 23.1.20240624 mishandles an ORDER BY clause. CVSS 3.1CRITICAL 9.8
  • TI-2007-03051 Unspecified vulnerability in Walter Zorn wz_tooltip.js (aka wz_tooltips) before 4.01, as… CVSS 2.0HIGH 10.0
  • TI-2008-01961 Multiple unspecified vulnerabilities in eGroupWare before 1.4.004 have unspecified attack… CVSS 2.0HIGH 10.0
  • TI-2007-03052 Unspecified vulnerability in eGroupWare before 1.2.107-2 has unknown impact and attack… CVSS 2.0HIGH 10.0
  • TI-2010-03166 phpgwapi/js/fckeditor/editor/dialog/fck_spellerpages/spellerpages/serverscripts/spellchec… CVSS 2.0HIGH 7.5
  • TI-2014-02389 EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before… CVSS 2.0HIGH 8.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences