CVE-2026-40187
Received Received - Intake

Authenticated Admin RCE in eGroupware via Malicious eTemplate

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (`.xet`) to the VFS `/etemplates` mount. The `Widget::expand_name()` method passes template widget attribute values directly into a PHP `eval()` call with only double-quote escaping applied - **backtick characters are not escaped**. In PHP, backticks inside a double-quoted `eval()` string execute shell commands. This allows an admin-level user to escalate from web application access to arbitrary OS command execution on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-40187
EUVD
EUVD-2026-46033

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
egroupware egroupware to 26.4.20260413 (exc)
egroupware egroupware to 23.1.20260601 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an authenticated administrator in EGroupware versions 26.0 and earlier to execute arbitrary operating system commands on the server. The issue occurs when an admin uploads a specially crafted eTemplate XML file (.xet) to the VFS /etemplates directory. The Widget::expand_name() method processes template attributes using a PHP eval() call that fails to escape backtick characters. In PHP, backticks inside double-quoted eval() strings execute shell commands, enabling OS-level command injection.

Detection Guidance

Check for unauthorized .xet files in the /etemplates directory of your egroupware installation. Review recent uploads by admins and inspect Widget::expand_name() method in api/src/Etemplate/Widget.php for eval() usage with backtick handling. Monitor for unexpected shell commands in logs or unusual network activity from the web server user.

Impact Analysis

An attacker with admin access could exploit this to run any command on the server as the web server user. This could allow reading sensitive files, accessing other services, or establishing persistent access. The impact depends on server configuration and network access but could lead to full system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. A successful exploit may result in data breaches, unauthorized disclosure, or system modifications that compromise compliance.

Mitigation Strategies

Upgrade egroupware to versions 26.4.20260413 or 23.1.20260601 or later. Disable eval() usage in templates if possible. Restrict admin uploads to trusted sources only. Review php.ini to ensure disable_functions blocks shell_exec and similar commands. For Docker deployments, verify hardening measures are active.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-40187. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart