CVE-2026-40187

Name of the Vulnerable Software and Affected Versions egroupware versions 26.0 and earlier

Description An authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (.xet) to the VFS /etemplates mount. The issue exists in the Widget::expand name() function within api/src/Etemplate/Widget.php, which passes template widget attribute values into a PHP eval() call. While double quotes are escaped, backtick characters are not. In PHP, backticks inside a double-quoted eval() string act as shell execution operators, allowing an attacker to execute arbitrary OS commands as the web server user. This can lead to the exposure of configuration files, database credentials, or full system compromise.

Recommendations Update egroupware to a version later than 26.0. As a temporary mitigation, configure the php.ini file to include disable functions = exec,passthru,shell exec,system,proc open,popen to block the execution of shell commands via PHP backticks.