Remote Code Execution in WookTeam Project Export

Executive Summary

CVE-2026-88393 is a remote code execution (RCE) vulnerability in WookTeam versions 1.6.6 and earlier. It exists in the /api/project/task/export interface where user input is base64-decoded and passed to an eval() function without validation. The data parameter is processed by string2array() in app/Module/Base.php, which executes eval("$array = $data;") if the decoded string starts with 'array' but isn't exactly 'array'. This allows attackers to inject arbitrary PHP code for RCE.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for requests to /api/project/task/export with base64-encoded data parameters. Check server logs for unusual eval() calls or PHP code execution attempts. Inspect app/Module/Base.php for the string2array() function and eval() usage with user-controlled input.

Useful 0 Not Useful 0

Impact Analysis

An attacker with a registered account can exploit this to execute arbitrary commands on the server. They can create projects, tasks, and trigger exports with malicious payloads. The vulnerability enables full system compromise, data theft, or installation of web shells for persistent access. It requires only basic user privileges and default public registration settings.

Useful 0 Not Useful 0

Compliance Impact

This RCE vulnerability could lead to unauthorized data access, modification, or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using vulnerable WookTeam versions may face compliance violations, regulatory fines, and reputational damage due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade WookTeam to a patched version beyond 1.6.6. Disable public registration if not required. Restrict access to /api/project/task/export to authenticated users only. Implement strict input validation for the data parameter to prevent base64-decoded code injection. Disable eval() usage entirely if possible.

Useful 0 Not Useful 0