CVE-2026-27823
HighCVSS 8.7Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
A vulnerability in EGroupware allows an authenticated attacker to achieve Remote Code Execution (RCE) on the server. If self-registration is enabled, it may be exploitable without authentication. The issue stems from improper authorization checks combined with file write and arbitrary file read primitives.
Risk Assessment
An attacker can fully compromise the EGroupware server, leading to data breach and service disruption.
Recommendation
Update EGroupware to version 26.2.20260224 or 23.1.20260224.
Other vulnerabilities in EGroupware
See all- CVE-2014-2027High
eGroupware before 1.8.006.20140217 is vulnerable to PHP object injection attacks, allowing remote attackers to delete arbitrary files and possibly execute arbitrary code.
- CVE-2026-40187High
In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (.xet) to the VFS /etemplates mount. The Widget::expand_name() method passes template widget attribute values directly into a PHP eval() call with only double-quote escaping applied - backtick characters are not escaped. In PHP, backticks inside a double-quoted eval() string execute shell commands, allowing an admin-level user to escalate from web application access to arbitrary OS command execution on the server.
Original NVD description (English source)
A vulnerability has been identified in EGroupware that may lead to Remote Code Execution (RCE). The issue allows an authenticated attacker to execute arbitrary commands on the server. If user self-registration is enabled, the vulnerability may be exploitable without prior authentication. The vulnerability stems from improper authorization checks combined with a file write primitive and an arbitrary file read vulnerability, which together enable full system compromise. This has been patched in versions 26.2.20260224 and 23.1.20260224.