What is the CVSS score of CVE-2026-45016?

CVE-2026-45016 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Is there a public PoC exploit available for CVE-2026-45016?

Yes, a public proof-of-concept exploit is available for CVE-2026-45016. Prioritise patching immediately.

Is there a patch available for CVE-2026-45016?

Yes, a patch is available for CVE-2026-45016. Update the affected software to the latest version immediately.

EGroupware CVE-2026-45016

MEDIUM

External Control of File Name or Path (CWE-73)

2026-07-07 https://github.com/EGroupware/egroupware

GHSA-c8m7-r2jv-rw63

PHP RCE

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable exploit requiring only authenticated mail-user session; no integrity or availability impact; high confidentiality loss via arbitrary file read.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 13:44 vuln.today

DescriptionGitHub Advisory

Summary

The function processes image URLs embedded in an HTML email body without validating or restricting URI schemes. The check !str_starts_with($myUrl, 'http') evaluates to true for file:// URIs, causing file_get_contents($basedir . urldecode($myUrl)) to read arbitrary files from the server filesystem and embed them as inline MIME attachments in outgoing email.

str_starts_with('file:///etc/passwd', 'http') → false !false → true

php

// api/src/Mail.php
foreach($images[2] as $i => $url)
			{
				//$isData = false;
				$basedir = $data = '';
				$needTempFile = true;
				$attachmentData = ['name' => '', 'type' => '', 'file' => '', 'tmp_name' => ''];
				try
				{
					// do not change urls for absolute images (thanks to corvuscorax)
					if (!str_starts_with($url, 'data:'))
					{
						$attachmentData['name'] = basename($url); // need to resolve all sort of url
						if (($directory = dirname($url)) == '.') $directory = '';
						$ext = pathinfo($attachmentData['name'], PATHINFO_EXTENSION);
						$attachmentData['type'] = MimeMagic::ext2mime($ext);
						if ( strlen($directory) > 1 && !str_ends_with($directory, '/')) { $directory .= '/'; }
..
...
....
// processURL2InlineImages function
if ( $myUrl[0]!='/' && strlen($basedir) > 1 && !str_ends_with($basedir, '/')) { $basedir .= '/'; }
						if ($needTempFile && empty($attachment) && !str_starts_with($myUrl, "http"))
						{
							try {
								$data = file_get_contents($basedir.urldecode($myUrl));
							}
							catch (\Throwable $e) {
								_egw_log_exception($e);
							}
						}
					}
					if (str_starts_with($url, 'data:'))

PoC

Log in as any authenticated EGroupware user with mail access and open the mail compose window.
Switch to HTML body mode and insert: <img src="file:///etc/passwd">.
The server executes file_get_contents('file:///etc/passwd'), writes the content to a temp file, and attaches it as an inline MIME part.

Impact

An authenticated attacker can read arbitrary files accessible by the web server process, including /etc/passwd, application configuration files containing database credentials, private TLS keys, and environment files.

Remediation

Enforce a strict URI scheme allowlist before calling file_get_contents(). Replace the check !str_starts_with($myUrl, 'http') with if (!preg_match('#^https?://#i', $myUrl)) { continue; } to reject file://, ftp://, php://, data://, and any other non-HTTP scheme.

AnalysisAI

Arbitrary file read in EGroupware's mail composition module allows any authenticated user with mail access to exfiltrate files readable by the web server process. The vulnerability stems from a defective URI scheme check in api/src/Mail.php that correctly rejects data: URIs but inadvertently permits file:// URIs, which PHP's file_get_contents() resolves natively against the local filesystem. A publicly available proof-of-concept exists demonstrating /etc/passwd extraction via a crafted HTML email body; no active exploitation (CISA KEV) has been confirmed at time of analysis.

Technical ContextAI

The affected code is in the processURL2InlineImages function within api/src/Mail.php of the EGroupware PHP groupware platform (CPE: pkg:composer/egroupware_egroupware). The function is designed to convert externally linked images in HTML email bodies into inline MIME attachments. The root-cause class is CWE-73 (External Control of File Name or Path): the URI scheme guard !str_starts_with($myUrl, 'http') was intended to distinguish remote HTTP resources from local relative paths, but file:///etc/passwd does not start with 'http', so the condition evaluates to true and file_get_contents($basedir . urldecode($myUrl)) is called with an attacker-controlled absolute file path. The additional urldecode() call prior to filesystem access may also permit percent-encoded path traversal sequences. PHP's file_get_contents() transparently supports file://, php://, ftp://, and other schemes unless explicitly restricted, making a simple prefix check wholly insufficient as a security boundary.

RemediationAI

Apply the vendor-released patch as documented in the GitHub Security Advisory GHSA-c8m7-r2jv-rw63 (https://github.com/EGroupware/egroupware/security/advisories/GHSA-c8m7-r2jv-rw63); an exact fixed release version was not confirmed in the provided input data, so administrators should consult the advisory directly to identify the minimum safe version. The recommended code fix is to replace the flawed !str_starts_with($myUrl, 'http') check with a strict allowlist: if (!preg_match('#^https?://#i', $myUrl)) { continue; } - this rejects file://, php://, ftp://, data://, and any other non-HTTP/HTTPS scheme before file_get_contents() is reached. As an interim compensating control where patching is not immediately possible, restrict web server process permissions to limit the set of files readable by the www-data (or equivalent) user, and consider blocking outbound MIME embedding by disabling HTML inline image processing at the mail server configuration level; note this degrades email rendering fidelity. Web application firewall rules blocking file:// or php:// strings in POST request bodies targeting the mail compose endpoint can reduce exploitability but should not be treated as a substitute for the code fix.