CVE-2026-27823: EGroupware remote code execution via improper authorization and file write

CVE-2026-27823 · Severity: critical · CVSS 4 · Published 2026-07-20

EGroupware, an enterprise collaboration and project management platform, contains a vulnerability that allows attackers to execute unauthorized commands on the server. By exploiting flaws in how the system verifies user permissions and handles file uploads, an attacker can gain full control over the application and its data. If the software is configured to allow new users to register themselves, this attack can be carried out by anyone with network access to the server.

Technologies: EGroupware GmbH EGroupware, egroupware/egroupware (Packagist). Vendors: EGroupware GmbH, Packagist.

Quick answers

Is CVE-2026-27823 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-27823 being exploited in the wild.
How severe is CVE-2026-27823?
Critical severity, with a CVSS score of 4, published 20 July 2026.
Which products and versions are affected?
EGroupware GmbH EGroupware <= 26.2.20260216, <= 23.1.20260131; egroupware/egroupware (Packagist) ECOSYSTEM:introduced=26.0.20251208,fixed=26.2.20260224.
Is there a fix for CVE-2026-27823?
Yes. egroupware/egroupware (Packagist): upgrade to 26.2.20260224 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27823 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-27823?
Check whether you run EGroupware GmbH EGroupware or egroupware/egroupware (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • egroupware/egroupware (Packagist): upgrade to 26.2.20260224 or later
    composer require egroupware/egroupware:^26.2.20260224

Technical details

A critical vulnerability in EGroupware arises from a combination of improper authorization in the SmallPartMediaRecorder::ajax_upload() function and an arbitrary file read vulnerability in importexport_export_ui::download. An attacker can bypass the 'isTeacher' check by manipulating the 'participant_role' in a crafted request, granting them a file write primitive. By using the file read vulnerability to obtain the contents of 'header.inc.php' and then using the write primitive with path traversal to overwrite it, an attacker can inject arbitrary PHP code. This leads to Remote Code Execution (RCE) once OPcache expires or the server restarts. The issue is patched in versions 26.2.20260224 and 23.1.20260224.

Affected products

  • EGroupware egroupware <= 26.2.20260216, <= 23.1.20260131

Identifiers

  • CVE-2026-27823
  • GHSA-h9qx-v5xp-ph8p

Timeline

  • 2026-07-06: advisory: Vendor advisory published on GitHub
  • 2026-07-20: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.