CVE-2026-88393
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array() function in app/Module/Base.php, which executes eval("\$array = $data;") whenever the decoded string starts with array. An attacker can inject arbitrary PHP code into the eval call and achieve RCE.
Risk Assessment
The risk is critical because it allows remote code execution on the server, which could lead to full system compromise. The attack can be performed remotely without authentication.
Recommendation
It is recommended to immediately upgrade WookTeam to the latest version and remove or secure the eval function. Also restrict access to the export endpoint.
Other vulnerabilities in WookTeam
Original NVD description (English source)
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array() function in app/Module/Base.php, which executes eval("\$array = $data;") whenever the decoded string starts with array. An attacker can inject arbitrary PHP code into the eval call and achieve RCE.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS