CVE-2026-40187: EGroupware eTemplate RCE Vulnerability

CVE-2026-40187 Overview

CVE-2026-40187 is an authenticated Remote Code Execution (RCE) vulnerability in EGroupware version 26.0 and earlier. An administrator can upload a malicious eTemplate XML file (.xet) to the Virtual File System (VFS) /etemplates mount and achieve OS-level command execution. The Widget::expand_name() method passes template widget attribute values into a PHP eval() call while applying only double-quote escaping. Backtick characters are not filtered, and PHP interprets backticks inside double-quoted eval() strings as shell command execution. The flaw is classified under [CWE-78: OS Command Injection].

Critical Impact
An authenticated administrator can escalate from web application access to arbitrary operating system command execution on the EGroupware server.

Affected Products

EGroupware version 26.0
EGroupware versions prior to 26.0
Deployments exposing the VFS /etemplates mount to administrators

Discovery Timeline

2026-07-20 - CVE-2026-40187 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-40187

Vulnerability Analysis

EGroupware processes eTemplate XML files through the Widget::expand_name() method. This method resolves dynamic widget attribute names by passing template-controlled values into PHP's eval() construct. The intent is to allow variable interpolation inside attribute names using PHP double-quoted string semantics.

The sanitization layer escapes double-quote characters to prevent breakout from the surrounding string literal. However, the escape routine does not neutralize backtick characters. In PHP, a backtick expression inside a double-quoted string that reaches eval() triggers the shell execution operator, which forwards the enclosed text to the system shell.

An administrator who uploads a crafted .xet file to the VFS /etemplates mount can therefore execute arbitrary operating system commands under the privileges of the PHP process, typically the web server user.

Root Cause

The root cause is incomplete input sanitization prior to dynamic code evaluation. The expand_name() routine trusts template attribute values as safe once double quotes are escaped, but PHP's double-quoted string grammar supports additional metacharacters. Backticks bypass the filter and reach the shell execution operator inside eval().

Attack Vector

Exploitation requires authenticated administrator access. The attacker crafts an eTemplate XML file containing a widget attribute whose value embeds a backtick-wrapped shell command. The file is uploaded to the VFS path /etemplates. When the template is rendered, Widget::expand_name() evaluates the attribute string, PHP interprets the backticks, and the shell command runs on the host.

Because the vector is network-accessible via the standard EGroupware web interface and requires no user interaction beyond the administrator's own actions, the impact spans confidentiality, integrity, and availability of the host.

No public proof-of-concept exploit code is referenced in the advisory. Refer to the GitHub Security Advisory GHSA-8737-2x9g-xjj7 for maintainer-provided technical details.

Detection Methods for CVE-2026-40187

Indicators of Compromise

Newly created or modified .xet files under the VFS /etemplates mount that were not deployed by an administrator during a legitimate change window.
Web server or PHP-FPM processes spawning child shell processes such as /bin/sh, bash, curl, wget, or python immediately after eTemplate rendering.
Outbound network connections from the EGroupware host to attacker-controlled infrastructure following administrator authentication events.

Detection Strategies

Monitor process ancestry for PHP or web server workers executing shell commands, which is anomalous for a normal EGroupware runtime.
Enable file integrity monitoring on the EGroupware VFS storage backend, particularly the /etemplates path.
Correlate administrator login events with subsequent template uploads and outbound network activity.

Monitoring Recommendations

Ingest web server access logs, PHP error logs, and EGroupware audit logs into a centralized analytics platform for retention and cross-source correlation.
Alert on any .xet file uploads containing backtick characters or shell metacharacters within widget attribute values.
Review administrator account activity for unexpected sessions, IP address changes, or template management actions.

How to Mitigate CVE-2026-40187

Immediate Actions Required

Upgrade EGroupware to a version that includes the fix for CVE-2026-40187 as published in the vendor security advisory.
Audit the VFS /etemplates mount for unauthorized or unexpected .xet files and remove any suspicious templates.
Rotate credentials for all EGroupware administrator accounts and review recent administrative activity for signs of abuse.

Patch Information

The vendor has published remediation guidance in the EGroupware GitHub Security Advisory GHSA-8737-2x9g-xjj7. Administrators should apply the fixed release identified in the advisory and validate that Widget::expand_name() no longer forwards unsanitized backtick characters to eval().

Workarounds

Restrict administrator role assignment to a minimum set of trusted operators until patching is complete.
Apply file system permissions on the VFS storage backend to prevent write access to /etemplates outside of controlled change processes.
Place the EGroupware administrative interface behind network access controls such as VPN or IP allowlisting to reduce exposure of privileged endpoints.

bash

# Configuration example: restrict access to the EGroupware admin interface at the reverse proxy
location /egroupware/admin {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://egroupware_backend;
}