What is the CVSS score of CVE-2026-22243?

CVE-2026-22243 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-22243?

A high-severity SQL injection vulnerability in EGroupware's Nextmatch filter allows attackers to compromise database integrity and exfiltrate sensitive data.. A patch is available.

Is there a public PoC exploit available for CVE-2026-22243?

Yes, a public proof-of-concept exploit is available for CVE-2026-22243. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-22243?

Within 24 hours: Identify all systems running EGroupware versions prior to 23.1.20260113 or 26.0.20260113 and isolate them from external access; document inventory of affected instances. Within 7 days: Implement WAF rules blocking malicious Nextmatch filter payloads; restrict API access to trusted IP ranges; enable enhanced logging on database queries for forensic analysis. Within 30 days: Contact vendor for patch availability timeline; develop migration plan to patched versions; conduct database audit for signs of compromise.

PHP CVE-2026-22243

HIGH

SQL Injection (CWE-89)

2026-01-28 security-advisories@github.com

GHSA-rvxj-7f72-mhrx

PHP SQLi Egroupware

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 19, 2026 - 21:21 vuln.today

Public exploit code

CVE Published

Jan 28, 2026 - 17:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

EGroupware is a Web based groupware server written in PHP. A SQL Injection vulnerability exists in the core components of EGroupware prior to versions 23.1.20260113 and 26.0.20260113, specifically in the Nextmatch filter processing. The flaw allows authenticated attackers to inject arbitrary SQL commands into the WHERE clause of database queries. This is achieved by exploiting a PHP type juggling issue where JSON decoding converts numeric strings into integers, bypassing the is_int() security check used by the application. Versions 23.1.20260113 and 26.0.20260113 patch the vulnerability.

AnalysisAI

SQL injection in EGroupware's Nextmatch filter allows authenticated attackers to execute arbitrary database commands by exploiting PHP type juggling that bypasses integer validation checks. Public exploit code exists for this vulnerability affecting EGroupware versions prior to 23.1.20260113 and 26.0.20260113, and no patch is currently available. Attackers with valid credentials can manipulate WHERE clauses to extract sensitive data, modify records, or compromise database integrity.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects the core component of Egroupware. EGroupware is a Web based groupware server written in PHP. A SQL Injection vulnerability exists in the core components of EGroupware prior to versions 23.1.20260113 and 26.0.20260113, specifically in the Nextmatch filter processing. The flaw allows authenticated attackers to inject arbitrary SQL commands into the WHERE clause of database queries. This is achieved by exploiting a PHP type juggling issue where JSON decoding converts numeric strings into integers, bypassing the is_int() secur

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.