Egroupware - CraftedSignal Threat Feed

EGroupware Authenticated RCE via Malicious eTemplate Upload (CVE-2026-40187)

hello@craftedsignal.io — Tue, 07 Jul 2026 13:14:06 +0000

A critical vulnerability, CVE-2026-40187, has been identified in EGroupware, allowing an authenticated administrator to achieve OS-level Remote Code Execution (RCE). The flaw resides in the Widget::expand_name() method within api/src/Etemplate/Widget.php, which passes template widget attribute values into a PHP eval() call. Crucially, while double quotes are escaped, backtick characters are not. In PHP, backticks inside a double-quoted eval() string trigger shell command execution. This means a malicious eTemplate XML file (.xet) uploaded by an administrator can leverage this oversight to execute arbitrary commands on the host server. The vulnerability affects EGroupware versions >= 26.0.20251208 but < 26.0.20260113, and versions < 23.1.20260601. A mitigating factor exists in official Docker deployments, which typically set disable_functions in php.ini to block shell_exec(), but non-Docker or misconfigured installations are fully vulnerable.

Attack Chain

An attacker gains authenticated administrative access to an EGroupware instance.
The attacker navigates to the Admin -> Filemanager -> VFS Mounts section within EGroupware and clicks "Install custom templates" to mount the /etemplates directory with administrative write access.
The attacker crafts a malicious index.xet XML file that contains a payload, such as , embedding a shell command (touch /tmp/pwned_egw`) within a widget ID attribute.


The attacker uploads this malicious index.xet file to a specific path within the mounted VFS, typically /etemplates/admin/templates/default/index.xet, using the EGroupware file manager.
To trigger the vulnerability, the attacker then navigates to an EGroupware admin panel URL, such as https:///egroupware/index.php?menuaction=admin.admin_ui.index, which causes the application to load and process the custom template.
During template processing, the Widget::expand_name() method is invoked, and the specially crafted widget ID containing the backtick shell command is passed to a PHP eval() call.
Due to the unescaped backticks, the PHP interpreter executes the embedded shell command (touch /tmp/pwned_egw 2>/dev/null) on the underlying Linux operating system.
The shell command runs with the privileges of the web server user (e.g., www-data), creating or modifying files on the server and achieving RCE.


Impact
Successful exploitation of CVE-2026-40187 allows an attacker with administrative EGroupware credentials to elevate their privileges to arbitrary OS command execution as the web server user. From this position, an attacker can access sensitive system files (e.g., database credentials), establish persistence mechanisms, pivot to other internal systems, or completely compromise the EGroupware server and its data. The vulnerability directly affects any EGroupware installation that is not using the official Docker deployment with its hardened php.ini settings or has had disable_functions modified. While no specific victim count is provided, all non-hardened EGroupware instances are at risk.
Recommendation

Prioritize patching EGroupware installations to a version that addresses CVE-2026-40187 immediately.
Ensure that PHP's disable_functions directive in php.ini is properly configured to block functions like exec, passthru, shell_exec, system, proc_open, and popen on all EGroupware servers, especially non-Docker deployments.
Deploy the provided Sigma rule to detect suspicious process creation activities indicating potential exploitation of CVE-2026-40187.
Enable comprehensive process_creation logging on all Linux servers hosting EGroupware to capture command line arguments, parent processes, and user information, which is critical for the Sigma rule.
Block the execution of the commands identified in the IOCs (e.g., touch /tmp/pwned_egw, id > /tmp/pwned_egw) at endpoint protection layers where possible.



EGroupware Critical RCE Vulnerability (CVE-2026-27823)
hello@craftedsignal.io — Tue, 07 Jul 2026 13:12:53 +0000
A critical remote code execution (RCE) vulnerability, tracked as CVE-2026-27823, has been discovered in EGroupware, an open-source collaboration suite. This flaw allows an authenticated attacker to execute arbitrary code on the underlying server. In environments where user self-registration is enabled, the vulnerability can be exploited by an unauthenticated attacker, significantly broadening its impact. Discovered by Huong Kieu of Cenobe Security, the vulnerability stems from a chain of weaknesses: an improper authorization check in the SmallPartMediaRecorder::ajax_upload() function, which can be bypassed via crafted request data, an arbitrary file write due to path traversal, and a separate arbitrary file read vulnerability in importexport_export_ui::download. By combining these, attackers can overwrite critical PHP files, inject malicious code, and achieve full system compromise. The vulnerability affects composer/egroupware/egroupware versions prior to 23.1.20260224 and versions 26.0.20251208 through 26.1.20260223.
Attack Chain

Initial Access / Authentication Bypass: An attacker, potentially unauthenticated if self-registration is enabled, crafts a POST request to /egroupware/json.php targeting the SmallPartMediaRecorder::ajax_upload() function.
Authorization Bypass: The crafted request includes a manipulated JSON body with participant_role set to 3 (ROLE_TEACHER), bypassing the isTeacher check intended to restrict file uploads.
Arbitrary File Write: Following the authorization bypass, the attacker exploits a path traversal vulnerability via the video_type parameter to write an arbitrary file to a controlled path, such as ./header.inc.php.
Arbitrary File Read: A separate vulnerability is exploited by making a GET request to /egroupware/index.php?menuaction=importexport.importexport_export_ui.download with a malicious _filename parameter (e.g., ../../../usr/share/egroupware/header.inc.php) to read the original content of the target file.
Code Injection Preparation: The attacker combines the original header.inc.php content with injected PHP code (e.g., a webshell or administrative credential modification logic) to preserve file validity and ensure continued server operation.
Remote Code Execution: The attacker overwrites header.inc.php using the arbitrary file write vulnerability with the crafted content, leading to Remote Code Execution when the file is subsequently loaded by the web server.

Impact
Successful exploitation of CVE-2026-27823 leads to critical consequences, including full system compromise and complete takeover of the EGroupware instance. Attackers can gain arbitrary remote code execution on the server, allowing them to install backdoors, exfiltrate sensitive data, manipulate or destroy data, or pivot to other systems within the network. This could result in significant data breaches, operational disruption, and reputational damage for affected organizations. The ability to modify administrative setup passwords further enables persistent control over the EGroupware application.
Recommendation

Patch CVE-2026-27823 immediately: Upgrade EGroupware composer/egroupware/egroupware to version 23.1.20260224 or 26.2.20260224 to mitigate CVE-2026-27823.
Disable user self-registration: If not strictly necessary, disable user self-registration in EGroupware to reduce the attack surface for unauthenticated exploitation of CVE-2026-27823.
Deploy the Sigma rules in this brief: Integrate the provided Sigma rules into your SIEM to detect attempts at exploiting the authorization bypass, arbitrary file write, and arbitrary file read components of CVE-2026-27823.
Enable webserver logging: Ensure comprehensive logging for your EGroupware web server (access logs, error logs) to capture HTTP requests including method, URI, query parameters, and POST body details, which are critical for activating the detection rules.