Authenticated RCE via malicious eTemplate upload in EGroupware (CVE-2026-40187)

An authenticated administrator can achieve OS-level remote code execution by uploading a malicious eTemplate XML file (`.xet`) to the VFS `/etemplates` mount. The `Widget::expand_name()` method in `api/src/Etemplate/Widget.php` passes widget attribute values into a PHP `eval()` call with only double-quote escaping applied; backtick characters are not escaped, allowing shell command execution equivalent to `shell_exec()`. A compromised or malicious admin can escalate from web application access to arbitrary OS command execution as the web server user, enabling access to database credentials, lateral movement, and persistent access. Public POC available. Affected versions: - <26.4.20260413 - <23.1.20260601 We recommend updating to: 26.4.20260413, 23.1.20260601. CVSS 8.6 · our assessment: this_week Reference: https://github.com/EGroupware/egroupware/security/advisories/GHSA-8737-2x9g-xjj7 Details: https://vuln.today/cve/CVE-2026-40187