p PatchFirst

CVE-2026-40187

CVE-2026-40187 · Authenticated RCE via Malicious eTemplate Upload in EGroupware

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (`.xet`) to the VFS `/etemplates` mount. The `Widget::expand_name()` method passes template widget attribute values directly into a PHP `eval()` call with only double-quote escaping applied - **backtick characters are not escaped**. In PHP, backticks inside a double-quoted `eval()` string execute shell commands. This allows an admin-level user to escalate from web application access to arbitrary OS command execution on the server.

CVSS 8.6 · High · EPSS 0.9% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • egroupware

    Versions
    • <= 26.0: Affected

    No fix published

  • egroupware/egroupware Packagist

    Versions
    • 26.0.20251208
    • 26.0.20251216
    • 26.0.20260108
    • 26.0.20260113
    • 26.0.20260123
    • 26.1.20260130
    • 26.2.20260203
    • 26.2.20260207
    • 26.2.20260209
    • 26.2.20260216
    • 26.2.20260224
    • 26.3.20260316
    • 26.4.20260408
    Affected ranges
    • ECOSYSTEM: ≥ 26.0.20251208, < 26.4.20260413

    Update to 26.4.20260413

  • egroupware/egroupware Packagist

    Versions
    • 14.2.20150121
    • 14.2.20150206
    • 14.2.20150210
    • 14.2.20150212
    • 14.2.20150218
    • 14.2.20150310
    • 14.2.20150402
    • 14.2.20150421
    • 14.2.20150428
    • 14.2.20150429
    • 14.2.20150501
    • 14.2.20150603
    • 14.2.20150707
    • 14.2.20150717
    • 14.3.20150728
    • 14.3.20150729
    • 14.3.20150811
    • 14.3.20150821
    • 14.3.20150826
    • 14.3.20150908
    • 14.3.20151012
    • 14.3.20151027
    • 14.3.20151028
    • 14.3.20151029
    • 14.3.20151030
    • 14.3.20151110
    • 14.3.20151130
    • 14.3.20151201
    • 14.3.20160112
    • 14.3.20160113
    • 14.3.20160304
    • 14.3.20160428
    • 14.3.20160512
    • 14.3.20160522
    • 14.3.20160524
    • 14.3.20160525
    • 14.3.20160708
    • 16.1.20160603
    • 16.1.20160621
    • 16.1.20160627
    • 16.1.20160630
    • 16.1.20160708
    • 16.1.20160715
    • 16.1.20160801
    • 16.1.20160810
    • 16.1.20160905
    • 16.1.20161006
    • 16.1.20161102
    • 16.1.20161107
    • 16.1.20161208
    • 16.1.20170118
    • 16.1.20170203
    • 16.1.20170315
    • 16.1.20170415
    • 16.1.20170612
    • 16.1.20170613
    • 16.1.20170703
    • 16.1.20170922
    • 16.1.20171106
    • 16.1.20180116
    • 16.1.20180130
    • 17.1.20171023
    • 17.1.20171106
    • 17.1.20171115
    • 17.1.20171129
    • 17.1.20171130
    • 17.1.20171218
    • 17.1.20180118
    • 17.1.20180130
    • 17.1.20180209
    • 17.1.20180321
    • 17.1.20180413
    • 17.1.20180523
    • 17.1.20180625
    • 17.1.20180720
    • 17.1.20180831
    • 17.1.20181018
    • 17.1.20181204
    • 17.1.20181205
    • 17.1.20190111
    • 17.1.20190214
    • 17.1.20190222
    • 17.1.20190402
    • 17.1.20190529
    • 17.1.20190808
    • 19.1.20190716
    • 19.1.20190717
    • 19.1.20190726
    • 19.1.20190806
    • 19.1.20190813
    • 19.1.20190822
    • 19.1.20190917
    • 19.1.20190925
    • 19.1.20191031
    • 19.1.20191119
    • 19.1.20191220
    • 19.1.20200130
    • 19.1.20200318
    • 19.1.20200409
    • 19.1.20200430
    • 19.1.20200605
    • 19.1.20200701
    • 20.1.20200525
    • 20.1.20200613
    • 20.1.20200628
    • 20.1.20200710
    • 20.1.20200716
    • 20.1.20200728
    • 20.1.20200731
    • 20.1.20200810
    • 20.1.20200812
    • 20.1.20200818
    • 20.1.20200901
    • 20.1.20200914
    • 20.1.20201005
    • 20.1.20201020
    • 20.1.20201028
    • 20.1.20201202
    • 20.1.20201217
    • 20.1.20210125
    • 20.1.20210324
    • 20.1.20210503
    • 21.1.20210318
    • 21.1.20210329
    • 21.1.20210406
    • 21.1.20210420
    • 21.1.20210504
    • 21.1.20210521
    • 21.1.20210629
    • 21.1.20210723
    • 21.1.20210923
    • 21.1.20211130
    • 21.1.20220207
    • 21.1.20220406
    • 21.1.20220408
    • 21.1.20220905
    • 21.1.20220916
    • 21.1.20221202
    • 21.1.20230210
    • 22.1.20220920
    • 23.1.20230110
    • 23.1.20230114
    • 23.1.20230125
    • 23.1.20230210
    • 23.1.20230228
    • 23.1.20230314
    • 23.1.20230328
    • 23.1.20230412
    • 23.1.20230428
    • 23.1.20230503
    • 23.1.20230524
    • 23.1.20230620
    • 23.1.20230726
    • 23.1.20230728
    • 23.1.20230824
    • 23.1.20230911
    • 23.1.20231110
    • 23.1.20231122
    • 23.1.20231129
    • 23.1.20231201
    • 23.1.20231219
    • 23.1.20231220
    • 23.1.20240125
    • 23.1.20240304
    • 23.1.20240430
    • 23.1.20240624
    • 23.1.20240905
    • 23.1.20240930
    • 23.1.20241008
    • 23.1.20241111
    • 23.1.20241128
    • 23.1.20241214
    • 23.1.20250113
    • 23.1.20250307
    • 23.1.20250416
    • 23.1.20250506
    • 23.1.20250715
    • 23.1.20250902
    • 23.1.20251021
    • 23.1.20251119
    • 23.1.20251222
    • 23.1.20260108
    • 23.1.20260113
    • 23.1.20260131
    • 23.1.20260224
    Affected ranges
    • ECOSYSTEM: < 23.1.20260601

    Update to 23.1.20260601

Original sources

Check your server →