Is CVE-2026-45016 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45016 being exploited in the wild.

How severe is CVE-2026-45016?

Medium severity, with a CVSS score of 6.5, published 7 July 2026.

Which products and versions are affected?

egroupware/egroupware (Packagist) ECOSYSTEM:introduced=26.0.20251208,fixed=26.5.20260507.

Is there a fix for CVE-2026-45016?

Yes. egroupware/egroupware (Packagist): upgrade to 26.5.20260507 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45016 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-45016?

Check whether you run egroupware/egroupware (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45016: EGroupware Local File Inclusion in Mail Compose

CVE-2026-45016 · Severity: medium · CVSS 6.5 · Published 2026-07-07

EGroupware is a collaboration software suite used for email, calendaring, and document management. A security flaw in the email composition tool allows an authorized user to trick the server into reading sensitive files from its own storage. This could lead to the exposure of system passwords, database credentials, or private encryption keys, potentially compromising the entire server.

Technologies: egroupware/egroupware (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-45016 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45016 being exploited in the wild.
How severe is CVE-2026-45016?: Medium severity, with a CVSS score of 6.5, published 7 July 2026.
Which products and versions are affected?: egroupware/egroupware (Packagist) ECOSYSTEM:introduced=26.0.20251208,fixed=26.5.20260507.
Is there a fix for CVE-2026-45016?: Yes. egroupware/egroupware (Packagist): upgrade to 26.5.20260507 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45016 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45016?: Check whether you run egroupware/egroupware (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

egroupware/egroupware (Packagist): upgrade to 26.5.20260507 or later
```
composer require egroupware/egroupware:^26.5.20260507
```

Technical details

A Local File Inclusion (LFI) vulnerability exists in EGroupware's mail composition logic within `api/src/Mail.php`. The application fails to properly validate URI schemes when processing image URLs in HTML email bodies. Specifically, the check `!str_starts_with($myUrl, 'http')` incorrectly permits `file://` URIs. When a user includes an `<img>` tag with a `file://` source, the server uses `file_get_contents()` to read the specified local file and attaches its contents as an inline MIME part in the outgoing email. This allows an authenticated attacker to exfiltrate sensitive files like `/etc/passwd` or configuration files. The issue is resolved in versions 26.5.20260507 and 23.1.20260601.

Affected products

EGroupware EGroupware >= 26.0.20251208, < 26.5.20260507; < 23.1.20260601

Identifiers

CVE-2026-45016
GHSA-c8m7-r2jv-rw63

Timeline

2026-07-07: advisory: GitHub Advisory GHSA-c8m7-r2jv-rw63 published
2026-07-07: disclosed: Vulnerability disclosed with CVE-2026-45016

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.