Executive brief
EGroupware is an enterprise collaboration and project management suite. A security vulnerability allows an administrator to execute arbitrary commands on the underlying server by uploading a specially crafted template file. While this requires high-level access, it allows a user to move beyond the application's boundaries to potentially access sensitive server files, databases, or other internal systems. Standard Docker installations are partially protected by default security settings, but other installation types are at high risk.
Technical details
An authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (.xet) to the VFS /etemplates mount. The vulnerability exists in the Widget::expand_name() method in api/src/Etemplate/Widget.php, which passes template widget attribute values into a PHP eval() call. While double quotes are escaped, backtick characters are not, allowing for shell command execution via PHP's backtick operator. This vulnerability is mitigated in official Docker deployments where shell_exec is disabled via php.ini, but affects bare-metal, VM, or custom container deployments without such hardening. The issue is patched in versions 26.4.20260413 and 23.1.20260601.
Affected products
- EGroupware egroupware < 26.4.20260413, < 23.1.20260601
Timeline
- 2026-07-06: advisory: Vendor advisory published on GitHub
- 2026-07-20: disclosed: CVE published to NVD