Read the docs
TI-2026-29001 Aliases CVE-2026-40187GHSA-8737-2x9g-xjj7

Authenticated RCE via Malicious eTemplate Upload in EGroupware

Priority HIGH 72CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (`.xet`) to the VFS `/etemplates` mount. The `Widget::expand_name()` method passes template widget attribute values directly into a PHP `eval()` call with only double-quote escaping applied - **backtick characters are not escaped**. In PHP, backticks inside a double-quoted `eval()` string execute shell commands. This allows an admin-level user to escalate from web application access to arbitrary OS command execution on the server.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00857 58th percentileScored 2026-11-07
Fix Fixed egroupware/egroupware (Packagist): 26.4.20260413, 23.1.20260601

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EGroupwareegroupwareup to 26.0—No fix listedCNA
—egroupware/egroupware (Packagist)26.0.20251208 to before 26.4.2026041326.4.20260413Patch availableGHSA-8737-2x9g-xjj7
—egroupware/egroupware (Packagist)before 23.1.2026060123.1.20260601Patch availableGHSA-8737-2x9g-xjj7
  • egroupware VendorEGroupware Affected up to 26.0 Fixed in — No fix listed CNA
  • egroupware/egroupware (Packagist) Vendor— Affected 26.0.20251208 to before 26.4.20260413 Fixed in 26.4.20260413 Patch available GHSA-8737-2x9g-xjj7
  • egroupware/egroupware (Packagist) Vendor— Affected before 23.1.20260601 Fixed in 23.1.20260601 Patch available GHSA-8737-2x9g-xjj7

Remediation

  • Fix · GHSA-8737-2x9g-xjj7 egroupware/egroupware (Packagist) Fixed in 26.4.20260413 Advisory →
  • Fix · GHSA-8737-2x9g-xjj7 egroupware/egroupware (Packagist) Fixed in 23.1.20260601 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40187
  2. 2026-10-03 Alias added: GHSA-8737-2x9g-xjj7

References

Other 2

  • TI-2024-27031 EGroupware before 23.1.20240624 mishandles an ORDER BY clause. CVSS 3.1CRITICAL 9.8
  • TI-2026-17853 EGroupware has SQL Injection in Nextmatch Filter Processing CVSS 4.0HIGH 8.7
  • TI-2026-22175 Remote Code Execution Vulnerability in EGroupware CVSS 4.0HIGH 8.7
  • TI-2007-03051 Unspecified vulnerability in Walter Zorn wz_tooltip.js (aka wz_tooltips) before 4.01, as… CVSS 2.0HIGH 10.0
  • TI-2008-01961 Multiple unspecified vulnerabilities in eGroupWare before 1.4.004 have unspecified attack… CVSS 2.0HIGH 10.0
  • TI-2007-03052 Unspecified vulnerability in eGroupWare before 1.2.107-2 has unknown impact and attack… CVSS 2.0HIGH 10.0
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences