Vulnerability Description
In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (`.xet`) to the VFS `/etemplates` mount. The `Widget::expand_name()` method passes template widget attribute values directly into a PHP `eval()` call with only double-quote escaping applied - **backtick characters are not escaped**. In PHP, backticks inside a double-quoted `eval()` string execute shell commands. This allows an admin-level user to escalate from web application access to arbitrary OS command execution on the server.
Related Weaknesses (CWE)
References
- https://github.com/EGroupware/egroupware/security/advisories/GHSA-8737-2x9g-xjj7
- https://github.com/EGroupware/egroupware/security/advisories/GHSA-8737-2x9g-xjj7
FAQ
What is CVE-2026-40187?
CVE-2026-40187 is a documented vulnerability. In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (`.xet`) to the VFS `/etemplates` mo...
How severe is CVE-2026-40187?
CVSS scoring is not yet available for CVE-2026-40187. Check NVD for updates.
Is there a patch for CVE-2026-40187?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.