CyberRota Analysis
AI-GeneratedEgroupware versions 26.0 and earlier are vulnerable to OS-level Remote Code Execution due to improper handling of user-uploaded eTemplate XML files. An authenticated administrator can exploit this vulnerability by uploading a malicious template that leverages the `eval()` function in PHP, allowing for arbitrary command execution on the server. Organizations using affected versions should prioritize patching this vulnerability to mitigate the risk of administrative access being exploited for server compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (`.xet`) to the VFS `/etemplates` mount. The `Widget::expand_name()` method passes template widget attribute values directly into a PHP `eval()` call with only double-quote escaping applied - **backtick characters are not escaped**. In PHP, backticks inside a double-quoted `eval()` string execute shell commands. This allows an admin-level user to escalate from web application access to arbitrary OS command execution on the server.