CVE-2026-40187 Details
Description
In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (`.xet`) to the VFS `/etemplates` mount. The `Widget::expand_name()` method passes template widget attribute values directly into a PHP `eval()` call with only double-quote escaping applied - **backtick characters are not escaped**. In PHP, backticks inside a double-quoted `eval()` string execute shell commands. This allows an admin-level user to escalate from web application access to arbitrary OS command execution on the server.
A remote code execution vulnerability has been identified in EGroupware versions prior to 26.4.20260413 and 23.1.20260601. The issue allows authenticated administrators to execute arbitrary OS commands by uploading a malicious eTemplate XML file (.xet) to the VFS /etemplates mount. The vulnerability arises because the Widget::expand_name() method passes template widget attribute values directly into a PHP eval() call, applying only double-quote escaping. Backtick characters, which can execute shell commands in PHP, are not escaped, enabling admin-level users to escalate from web application access to OS-level command execution on the server.
Users can update to EGroupware versions 26.4.20260413 or 23.1.20260601 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 20, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/EGroupware/egroupware/security/advisories/GHSA-8737-2x9g-xjj7 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/EGroupware/egroupware/security/advisories/GHSA-8737-2x9g-xjj7 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| EGroupware | < 26.4.20260413 (semver) < 23.1.20260601 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |