Read the docs
TI-2026-22175 Aliases CVE-2026-27823GHSA-h9qx-v5xp-ph8p

Remote Code Execution Vulnerability in EGroupware

Priority MEDIUM 48CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285 and CWE-94.

Summary

A vulnerability has been identified in EGroupware that may lead to Remote Code Execution (RCE). The issue allows an authenticated attacker to execute arbitrary commands on the server. If user self-registration is enabled, the vulnerability may be exploitable without prior authentication. The vulnerability stems from improper authorization checks combined with a file write primitive and an arbitrary file read vulnerability, which together enable full system compromise. This has been patched in versions 26.2.20260224 and 23.1.20260224.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00975 62nd percentileScored 2026-11-07
Fix Fixed egroupware/egroupware (Packagist): 26.2.20260224, 23.1.20260224

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EGroupwareegroupwareup to 26.2.20260216; up to 23.1.20260131—No fix listedCNA
—egroupware/egroupware (Packagist)26.0.20251208 to before 26.2.2026022426.2.20260224Patch availableGHSA-h9qx-v5xp-ph8p
—egroupware/egroupware (Packagist)before 23.1.2026022423.1.20260224Patch availableGHSA-h9qx-v5xp-ph8p
  • egroupware VendorEGroupware Affected up to 26.2.20260216; up to 23.1.20260131 Fixed in — No fix listed CNA
  • egroupware/egroupware (Packagist) Vendor— Affected 26.0.20251208 to before 26.2.20260224 Fixed in 26.2.20260224 Patch available GHSA-h9qx-v5xp-ph8p
  • egroupware/egroupware (Packagist) Vendor— Affected before 23.1.20260224 Fixed in 23.1.20260224 Patch available GHSA-h9qx-v5xp-ph8p

Remediation

  • Fix · GHSA-h9qx-v5xp-ph8p egroupware/egroupware (Packagist) Fixed in 26.2.20260224 Advisory →
  • Fix · GHSA-h9qx-v5xp-ph8p egroupware/egroupware (Packagist) Fixed in 23.1.20260224 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27823
  2. 2026-10-03 Alias added: GHSA-h9qx-v5xp-ph8p

References

Other 2

  • TI-2024-27031 EGroupware before 23.1.20240624 mishandles an ORDER BY clause. CVSS 3.1CRITICAL 9.8
  • TI-2026-17853 EGroupware has SQL Injection in Nextmatch Filter Processing CVSS 4.0HIGH 8.7
  • TI-2026-29001 Authenticated RCE via Malicious eTemplate Upload in EGroupware CVSS 4.0HIGH 8.6
  • TI-2007-03051 Unspecified vulnerability in Walter Zorn wz_tooltip.js (aka wz_tooltips) before 4.01, as… CVSS 2.0HIGH 10.0
  • TI-2008-01961 Multiple unspecified vulnerabilities in eGroupWare before 1.4.004 have unspecified attack… CVSS 2.0HIGH 10.0
  • TI-2007-03052 Unspecified vulnerability in eGroupWare before 1.2.107-2 has unknown impact and attack… CVSS 2.0HIGH 10.0
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences