What is the CVSS score of CVE-2026-45016?

CVE-2026-45016 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Is there a public PoC exploit available for CVE-2026-45016?

Yes, a public proof-of-concept exploit is available for CVE-2026-45016. Prioritise patching immediately.

Is there a patch available for CVE-2026-45016?

Yes, a patch is available for CVE-2026-45016. Update the affected software to the latest version immediately.

EGroupware CVE-2026-45016

MEDIUM

External Control of File Name or Path (CWE-73)

2026-07-07 https://github.com/EGroupware/egroupware

GHSA-c8m7-r2jv-rw63

RCE PHP

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable exploit requiring only authenticated mail-user session; no integrity or availability impact; high confidentiality loss via arbitrary file read.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 13:44 vuln.today

DescriptionGitHub Advisory

Summary

The function processes image URLs embedded in an HTML email body without validating or restricting URI schemes. The check !str_starts_with($myUrl, 'http') evaluates to true for file:// URIs, causing file_get_contents($basedir . urldecode($myUrl)) to read arbitrary files from the server filesystem and embed them as inline MIME attachments in outgoing email.

str_starts_with('file:///etc/passwd', 'http') → false !false → true

php

// api/src/Mail.php
foreach($images[2] as $i => $url)
			{
				//$isData = false;
				$basedir = $data = '';
				$needTempFile = true;
				$attachmentData = ['name' => '', 'type' => '', 'file' => '', 'tmp_name' => ''];
				try
				{
					// do not change urls for absolute images (thanks to corvuscorax)
					if (!str_starts_with($url, 'data:'))
					{
						$attachmentData['name'] = basename($url); // need to resolve all sort of url
						if (($directory = dirname($url)) == '.') $directory = '';
						$ext = pathinfo($attachmentData['name'], PATHINFO_EXTENSION);
						$attachmentData['type'] = MimeMagic::ext2mime($ext);
						if ( strlen($directory) > 1 && !str_ends_with($directory, '/')) { $directory .= '/'; }
..
...
....
// processURL2InlineImages function
if ( $myUrl[0]!='/' && strlen($basedir) > 1 && !str_ends_with($basedir, '/')) { $basedir .= '/'; }
						if ($needTempFile && empty($attachment) && !str_starts_with($myUrl, "http"))
						{
							try {
								$data = file_get_contents($basedir.urldecode($myUrl));
							}
							catch (\Throwable $e) {
								_egw_log_exception($e);
							}
						}
					}
					if (str_starts_with($url, 'data:'))

PoC

Log in as any authenticated EGroupware user with mail access and open the mail compose window.
Switch to HTML body mode and insert: <img src="file:///etc/passwd">.
The server executes file_get_contents('file:///etc/passwd'), writes the content to a temp file, and attaches it as an inline MIME part.

Impact

An authenticated attacker can read arbitrary files accessible by the web server process, including /etc/passwd, application configuration files containing database credentials, private TLS keys, and environment files.

Remediation

Enforce a strict URI scheme allowlist before calling file_get_contents(). Replace the check !str_starts_with($myUrl, 'http') with if (!preg_match('#^https?://#i', $myUrl)) { continue; } to reject file://, ftp://, php://, data://, and any other non-HTTP scheme.

AnalysisAI

Arbitrary file read in EGroupware's mail composition module allows any authenticated user with mail access to exfiltrate files readable by the web server process. The vulnerability stems from a defective URI scheme check in api/src/Mail.php that correctly rejects data: URIs but inadvertently permits file:// URIs, which PHP's file_get_contents() resolves natively against the local filesystem. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Authenticate as low-privileged EGroupware mail user

Delivery

Open HTML email compose window

Exploit

Inject file:// URI in img src attribute

Install

Submit compose request to server

Server calls file_get_contents() on target path

Execute

File contents embedded as inline MIME attachment

Impact

Attacker retrieves file from received email

Recon

Authenticate as low-privileged EGroupware mail user

Delivery

Open HTML email compose window

Exploit

Inject file:// URI in img src attribute

Install

Submit compose request to server

Server calls file_get_contents() on target path

Execute

File contents embedded as inline MIME attachment

Impact

Attacker retrieves file from received email

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid EGroupware account with permission to compose HTML emails via the mail module - this is a standard user capability, not an administrative one. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD-reported CVSS 3.0 score is 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, which is consistent with the technical description: network-reachable, low-complexity, authenticated (PR:L), with high confidentiality impact and no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated EGroupware user with standard mail access opens the compose window, switches to HTML body mode, and embeds `<img src="file:///etc/passwd">` (or targets application configuration files such as `/var/www/egroupware/config.php`). Upon submission, the server's `processURL2InlineImages` function reads the specified file via `file_get_contents()` and attaches its contents as an inline MIME part in the outgoing email, which the attacker then receives and extracts. …
Remediation	Apply the vendor-released patch as documented in the GitHub Security Advisory GHSA-c8m7-r2jv-rw63 (https://github.com/EGroupware/egroupware/security/advisories/GHSA-c8m7-r2jv-rw63); an exact fixed release version was not confirmed in the provided input data, so administrators should consult the advisory directly to identify the minimum safe version. … Detailed patch versions, workarounds, and compensating controls in full report.