CVE-2026-40187 Authenticated RCE via Malicious eTemplate Upload in EGroupware
Authenticated administrators can execute arbitrary OS commands by uploading malicious eTemplate files due to unsafe PHP eval usage.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40187?
CVE-2026-40187 is a high-severity code injection vulnerability in egroupware, published on 20 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (`.xet`) to the VFS `/etemplates` mount. The `Widget::expand_name()` method passes template widget attribute values directly into a PHP `eval()` call with only double-quote escaping applied - **backtick characters are not escaped**. In PHP, backticks inside a double-quoted `eval()` string execute shell commands. This allows an admin-level user to escalate from web application access to arbitrary OS command execution on the server.
Which versions are affected by CVE-2026-40187?
4 open source packages ship an affected version, including egroupware/egroupware.
| Package | Affected | Fixed in |
|---|---|---|
egroupware/egroupware Packagist | All versions | 23.1.20260601 |
egroupware/egroupware Packagist | All versions | 23.1.20260601 |
egroupware/egroupware Packagist | From 26.0.20251208 | 26.4.20260413 |
egroupware/egroupware Packagist | From 26.0.20251208 | 26.4.20260413 |
How do I fix CVE-2026-40187?
Upgrade egroupware/egroupware to a fixed version for your release line: 23.1.20260601 or 26.4.20260413.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-40187 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40187 exists.
Sources
Also known as GHSA-8737-2x9g-xjj7.