What’s Vulnerable › Vulnerabilities

CVE-2026-40187: Authenticated RCE via Malicious eTemplate Upload in EGroupware

• Severity: high (CVSS 8.6 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-20 · updated 2026-07-23
• Weakness: CWE-78

Description

In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (`.xet`) to the VFS `/etemplates` mount. The `Widget::expand_name()` method passes template widget attribute values directly into a PHP `eval()` call with only double-quote escaping applied - **backtick characters are not escaped**. In PHP, backticks inside a double-quoted `eval()` string execute shell commands. This allows an admin-level user to escalate from web application access to arbitrary OS command execution on the server.

Affected products

• egroupware: through 26.0

References

• https://github.com/EGroupware/egroupware/security/advisories/GHSA-8737-2x9g-xjj7
• https://github.com/EGroupware/egroupware/security/advisories/GHSA-8737-2x9g-xjj7

Get alerted when CVE-2026-40187 or the next vulnerability affects your stack