CVE-2026-22243
SQL Injection in EGroupware Nextmatch Filter via PHP Type Juggling
Publication date: 2026-01-28
Last updated on: 2026-02-19
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| egroupware | egroupware | to 23.1.20260113 (exc) |
| egroupware | egroupware | From 26.0.20251208 (inc) to 26.0.20260113 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a SQL Injection flaw in EGroupware's core components before versions 23.1.20260113 and 26.0.20260113. It occurs in the Nextmatch filter processing, where authenticated attackers can inject arbitrary SQL commands into the WHERE clause of database queries. The issue arises due to a PHP type juggling problem where JSON decoding converts numeric strings into integers, allowing attackers to bypass the is_int() security check.
How can this vulnerability impact me? :
The vulnerability allows authenticated attackers to execute arbitrary SQL commands on the database, which can lead to unauthorized data access, data modification, or data deletion. This can compromise the integrity and confidentiality of the data managed by EGroupware.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade EGroupware to version 23.1.20260113 or 26.0.20260113 or later, as these versions contain patches that fix the SQL Injection flaw in the Nextmatch filter processing.