CVE-2026-40187: EGroupware RCE via malicious eTemplate upload in Widget::expand_name

CVE-2026-40187 · Severity: high · CVSS 4 · Published 2026-07-20

EGroupware is an enterprise collaboration and project management suite. A security vulnerability allows an administrator to execute arbitrary commands on the underlying server by uploading a specially crafted template file. While this requires high-level access, it allows a user to move beyond the application's boundaries to potentially access sensitive server files, databases, or other internal systems. Standard Docker installations are partially protected by default security settings, but other installation types are at high risk.

Technologies: EGroupware GmbH EGroupware, egroupware/egroupware (Packagist). Vendors: EGroupware GmbH, Packagist.

Quick answers

Is CVE-2026-40187 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40187 being exploited in the wild.
How severe is CVE-2026-40187?
High severity, with a CVSS score of 4, published 20 July 2026.
Which products and versions are affected?
EGroupware GmbH EGroupware < 26.4.20260413, < 23.1.20260601, >= 26.0.20251208, < 26.0.20260413; < 23.1.20260601; egroupware/egroupware (Packagist) ECOSYSTEM:introduced=26.0.20251208,fixed=26.4.20260413.
Is there a fix for CVE-2026-40187?
Yes. egroupware/egroupware (Packagist): upgrade to 26.4.20260413 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40187 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-40187?
Check whether you run EGroupware GmbH EGroupware or egroupware/egroupware (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • egroupware/egroupware (Packagist): upgrade to 26.4.20260413 or later
    composer require egroupware/egroupware:^26.4.20260413

Technical details

An authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (.xet) to the VFS /etemplates mount. The vulnerability exists in the Widget::expand_name() method in api/src/Etemplate/Widget.php, which passes template widget attribute values into a PHP eval() call. While double quotes are escaped, backtick characters are not, allowing for shell command execution via PHP's backtick operator. This vulnerability is mitigated in official Docker deployments where shell_exec is disabled via php.ini, but affects bare-metal, VM, or custom container deployments without such hardening. The issue is patched in versions 26.4.20260413 and 23.1.20260601.

Affected products

  • EGroupware egroupware < 26.4.20260413, < 23.1.20260601

Identifiers

  • CVE-2026-40187
  • GHSA-8737-2x9g-xjj7

Timeline

  • 2026-07-06: advisory: Vendor advisory published on GitHub
  • 2026-07-20: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.