# CVE-2026-45016: EGroupware Local File Inclusion in Mail Compose

Source: https://junglewise.ai/threats/cve-2026-45016-egroupware-local-file-inclusion-in-mail-compose  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-45016 · Severity: medium · CVSS 6.5 · Published 2026-07-07

EGroupware is a collaboration software suite used for email, calendaring, and document management. A security flaw in the email composition tool allows an authorized user to trick the server into reading sensitive files from its own storage. This could lead to the exposure of system passwords, database credentials, or private encryption keys, potentially compromising the entire server.

Technologies: [egroupware/egroupware (Packagist)](https://junglewise.ai/threats/technologies/egroupware-egroupware). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-45016 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45016 being exploited in the wild.

**How severe is CVE-2026-45016?** Medium severity, with a CVSS score of 6.5, published 7 July 2026.

**Which products and versions are affected?** egroupware/egroupware (Packagist) ECOSYSTEM:introduced=26.0.20251208,fixed=26.5.20260507.

**Is there a fix for CVE-2026-45016?** Yes. egroupware/egroupware (Packagist): upgrade to 26.5.20260507 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45016 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45016?** Check whether you run egroupware/egroupware (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- egroupware/egroupware (Packagist): upgrade to 26.5.20260507 or later

  ```sh
  composer require egroupware/egroupware:^26.5.20260507
  ```


## Technical details

A Local File Inclusion (LFI) vulnerability exists in EGroupware's mail composition logic within `api/src/Mail.php`. The application fails to properly validate URI schemes when processing image URLs in HTML email bodies. Specifically, the check `!str_starts_with($myUrl, 'http')` incorrectly permits `file://` URIs. When a user includes an `<img>` tag with a `file://` source, the server uses `file_get_contents()` to read the specified local file and attaches its contents as an inline MIME part in the outgoing email. This allows an authenticated attacker to exfiltrate sensitive files like `/etc/passwd` or configuration files. The issue is resolved in versions 26.5.20260507 and 23.1.20260601.

## Affected products

- EGroupware EGroupware >= 26.0.20251208, < 26.5.20260507; < 23.1.20260601

## Identifiers

- CVE-2026-45016
- GHSA-c8m7-r2jv-rw63

## Timeline

- 2026-07-07: advisory: GitHub Advisory GHSA-c8m7-r2jv-rw63 published
- 2026-07-07: disclosed: Vulnerability disclosed with CVE-2026-45016

## References

- [https://api.github.com/users/smitocaru](https://api.github.com/users/smitocaru)
- [https://github.com/smitocaru](https://github.com/smitocaru)
- [https://api.github.com/users/smitocaru/gists%7B/gist_id%7D](https://api.github.com/users/smitocaru/gists%7B/gist_id%7D)
- [https://api.github.com/users/smitocaru/repos](https://api.github.com/users/smitocaru/repos)
- [https://avatars.githubusercontent.com/u/210701446?v=4](https://avatars.githubusercontent.com/u/210701446?v=4)
- [https://api.github.com/users/smitocaru/events%7B/privacy%7D](https://api.github.com/users/smitocaru/events%7B/privacy%7D)

## Related threats

- [EGroupware RCE via malicious eTemplate upload in Widget::expand_name](https://junglewise.ai/threats/cve-2026-40187-egroupware-rce-via-malicious-etemplate-upload-in-widget-expand)
- [EGroupware remote code execution via improper authorization and file write](https://junglewise.ai/threats/cve-2026-27823-egroupware-remote-code-execution-via-improper-authorization-and)
- [EGroupware has SQL Injection in Nextmatch Filter Processing](https://junglewise.ai/threats/cve-2026-22243-egroupware-has-sql-injection-in-nextmatch-filter-processing)
- [EGroupware mishandles an ORDER BY clause](https://junglewise.ai/threats/cve-2024-40614-egroupware-mishandles-an-order-by-clause)
- [EGroupware Code Injection vulnerability](https://junglewise.ai/threats/cve-2010-3313-egroupware-code-injection-vulnerability)