Egroupware vulnerabilities
We track 4 vulnerabilities in Egroupware products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on July 20, 2026.
Latest Egroupware vulnerabilities
- 8.6 High severity
egroupware: Improper Neutralization of Special Elements used in an OS Command
In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (`.xet`) to the VFS `/etemplates` mount. The `Widget::expand_name()` method passes template widg
- 8.7 High severity
egroupware: Improper Authorization
A vulnerability has been identified in EGroupware that may lead to Remote Code Execution (RCE). The issue allows an authenticated attacker to execute arbitrary commands on the server. If user self-registration is enabled, the vulnerability may be exploitable w
- 8.8 High severity
egroupware: Improper Neutralization of Special Elements used in an SQL Command
EGroupware is a Web based groupware server written in PHP. A SQL Injection vulnerability exists in the core components of EGroupware prior to versions 23.1.20260113 and 26.0.20260113, specifically in the `Nextmatch` filter processing. The flaw allows authentic
- 9.8 Critical severity
Egroupware: Improper Neutralization of Special Elements used in an SQL Command
EGroupware before 23.1.20240624 mishandles an ORDER BY clause. This leads to json.php?menuaction=EGroupware\Api\Etemplate\Widget\Nextmatch::ajax_get_rows sort.id SQL injection by authenticated users for Address Book or InfoLog sorting.