Executive brief
EGroupware, an enterprise collaboration and project management platform, contains a vulnerability that allows attackers to execute unauthorized commands on the server. By exploiting flaws in how the system verifies user permissions and handles file uploads, an attacker can gain full control over the application and its data. If the software is configured to allow new users to register themselves, this attack can be carried out by anyone with network access to the server.
Technical details
A critical vulnerability in EGroupware arises from a combination of improper authorization in the SmallPartMediaRecorder::ajax_upload() function and an arbitrary file read vulnerability in importexport_export_ui::download. An attacker can bypass the 'isTeacher' check by manipulating the 'participant_role' in a crafted request, granting them a file write primitive. By using the file read vulnerability to obtain the contents of 'header.inc.php' and then using the write primitive with path traversal to overwrite it, an attacker can inject arbitrary PHP code. This leads to Remote Code Execution (RCE) once OPcache expires or the server restarts. The issue is patched in versions 26.2.20260224 and 23.1.20260224.
Affected products
- EGroupware egroupware <= 26.2.20260216, <= 23.1.20260131
Timeline
- 2026-07-06: advisory: Vendor advisory published on GitHub
- 2026-07-20: disclosed: CVE published to NVD