{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/composer/egroupware/egroupware--23.1.20260224/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["composer/egroupware/egroupware (\u003e= 26.0.20251208, \u003c 26.2.20260224)","composer/egroupware/egroupware (\u003c 23.1.20260224)"],"_cs_severities":["critical"],"_cs_tags":["RCE","web-vulnerability","egroupware","php","critical","exploit"],"_cs_type":"advisory","_cs_vendors":["EGroupware"],"content_html":"\u003cp\u003eA critical remote code execution (RCE) vulnerability, tracked as CVE-2026-27823, has been discovered in EGroupware, an open-source collaboration suite. This flaw allows an authenticated attacker to execute arbitrary code on the underlying server. In environments where user self-registration is enabled, the vulnerability can be exploited by an unauthenticated attacker, significantly broadening its impact. Discovered by Huong Kieu of Cenobe Security, the vulnerability stems from a chain of weaknesses: an improper authorization check in the \u003ccode\u003eSmallPartMediaRecorder::ajax_upload()\u003c/code\u003e function, which can be bypassed via crafted request data, an arbitrary file write due to path traversal, and a separate arbitrary file read vulnerability in \u003ccode\u003eimportexport_export_ui::download\u003c/code\u003e. By combining these, attackers can overwrite critical PHP files, inject malicious code, and achieve full system compromise. The vulnerability affects \u003ccode\u003ecomposer/egroupware/egroupware\u003c/code\u003e versions prior to \u003ccode\u003e23.1.20260224\u003c/code\u003e and versions \u003ccode\u003e26.0.20251208\u003c/code\u003e through \u003ccode\u003e26.1.20260223\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access / Authentication Bypass\u003c/strong\u003e: An attacker, potentially unauthenticated if self-registration is enabled, crafts a POST request to \u003ccode\u003e/egroupware/json.php\u003c/code\u003e targeting the \u003ccode\u003eSmallPartMediaRecorder::ajax_upload()\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAuthorization Bypass\u003c/strong\u003e: The crafted request includes a manipulated JSON body with \u003ccode\u003eparticipant_role\u003c/code\u003e set to \u003ccode\u003e3\u003c/code\u003e (ROLE_TEACHER), bypassing the \u003ccode\u003eisTeacher\u003c/code\u003e check intended to restrict file uploads.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eArbitrary File Write\u003c/strong\u003e: Following the authorization bypass, the attacker exploits a path traversal vulnerability via the \u003ccode\u003evideo_type\u003c/code\u003e parameter to write an arbitrary file to a controlled path, such as \u003ccode\u003e./header.inc.php\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eArbitrary File Read\u003c/strong\u003e: A separate vulnerability is exploited by making a GET request to \u003ccode\u003e/egroupware/index.php?menuaction=importexport.importexport_export_ui.download\u003c/code\u003e with a malicious \u003ccode\u003e_filename\u003c/code\u003e parameter (e.g., \u003ccode\u003e../../../usr/share/egroupware/header.inc.php\u003c/code\u003e) to read the original content of the target file.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCode Injection Preparation\u003c/strong\u003e: The attacker combines the original \u003ccode\u003eheader.inc.php\u003c/code\u003e content with injected PHP code (e.g., a webshell or administrative credential modification logic) to preserve file validity and ensure continued server operation.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRemote Code Execution\u003c/strong\u003e: The attacker overwrites \u003ccode\u003eheader.inc.php\u003c/code\u003e using the arbitrary file write vulnerability with the crafted content, leading to Remote Code Execution when the file is subsequently loaded by the web server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-27823 leads to critical consequences, including full system compromise and complete takeover of the EGroupware instance. Attackers can gain arbitrary remote code execution on the server, allowing them to install backdoors, exfiltrate sensitive data, manipulate or destroy data, or pivot to other systems within the network. This could result in significant data breaches, operational disruption, and reputational damage for affected organizations. The ability to modify administrative setup passwords further enables persistent control over the EGroupware application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch CVE-2026-27823 immediately\u003c/strong\u003e: Upgrade EGroupware \u003ccode\u003ecomposer/egroupware/egroupware\u003c/code\u003e to version \u003ccode\u003e23.1.20260224\u003c/code\u003e or \u003ccode\u003e26.2.20260224\u003c/code\u003e to mitigate CVE-2026-27823.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDisable user self-registration\u003c/strong\u003e: If not strictly necessary, disable user self-registration in EGroupware to reduce the attack surface for unauthenticated exploitation of CVE-2026-27823.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDeploy the Sigma rules in this brief\u003c/strong\u003e: Integrate the provided Sigma rules into your SIEM to detect attempts at exploiting the authorization bypass, arbitrary file write, and arbitrary file read components of CVE-2026-27823.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eEnable webserver logging\u003c/strong\u003e: Ensure comprehensive logging for your EGroupware web server (access logs, error logs) to capture HTTP requests including method, URI, query parameters, and POST body details, which are critical for activating the detection rules.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-07T13:12:53Z","date_published":"2026-07-07T13:12:53Z","id":"https://feed.craftedsignal.io/briefs/2026-07-egroupware-rce/","summary":"A critical remote code execution vulnerability (CVE-2026-27823) in EGroupware allows an authenticated attacker, or an unauthenticated attacker if self-registration is enabled, to execute arbitrary commands on the server by combining an authorization bypass, arbitrary file write via path traversal, and arbitrary file read, leading to full system compromise.","title":"EGroupware Critical RCE Vulnerability (CVE-2026-27823)","url":"https://feed.craftedsignal.io/briefs/2026-07-egroupware-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Composer/Egroupware/Egroupware (\u003c 23.1.20260224)","version":"https://jsonfeed.org/version/1.1"}