EUVD-2026-92470
GHSA-fcw7-v723-7c9r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach /api/project/task/export endpoint
-
DeliveryCraft base64 'data' starting with 'array' + PHP payload
-
ExploitDecoded value flows into string2array()
-
Executioneval() executes injected PHP
-
ImpactArbitrary code execution on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires sending a request to the specific endpoint /api/project/task/export in WookTeam v1.6.6 or earlier, with a 'data' parameter whose base64-decoded content begins with the literal 'array' (the trigger condition that routes the value into eval() inside string2array() in app/Module/Base.php). No special non-default configuration or user interaction is described (UI:N). The main limiting factor is reachability of the export endpoint: the input's CVSS marks it PR:N (unauthenticated), but project/task export APIs commonly sit behind a login/session, so the realistic prerequisite may be a valid authenticated session or an exposed/mis-protected route - this should be verified against WookTeam's actual auth middleware. Overall risk is bounded by the product's limited deployment rather than by exploit difficulty. |
| Impact | Signals conflict on urgency. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) and the CWE-94 eval()-based code injection describe a maximally severe, trivially reachable network RCE, and SSVC reinforces this with Technical Impact: total and Automatable: yes. However, exploitation maturity is only 'poc' per SSVC, and EPSS is just 0.15% (4th percentile), indicating very low modeled probability of widespread exploitation in the near term. The vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation - status is publicly available exploit code exists (a PoC write-up is referenced). The low EPSS despite a critical score is consistent with a niche product that has small deployment footprint rather than a widely-weaponized flaw. One important caveat: CVSS lists PR:N (unauthenticated), but the affected endpoint (/api/project/task/export) is a project-task API that in many collaboration platforms requires an authenticated session - the input does not confirm whether this export route is reachable pre-auth, so the 'unauthenticated' qualifier should be verified against the actual WookTeam routing/middleware before treating this as a pre-auth internet-facing RCE. CPE/affected-version data is effectively absent (cpe:2.3:a:n/a:n/a and version 'n/a'), so asset inventory matching will be unreliable. Net: genuinely dangerous where WookTeam ≤1.6.6 is exposed, but low real-world fleet prevalence and PoC-only maturity make this a priority for WookTeam operators specifically rather than a broad emergency. |
| Exploit ScenarioDerived | An attacker reaches the /api/project/task/export endpoint and supplies a crafted 'data' parameter whose base64-decoded value begins with 'array' but embeds malicious PHP, which WookTeam's string2array() passes into eval("$array = $data;"), executing the attacker's PHP on the server. A public proof-of-concept write-up exists; because the attack is a single network request with low complexity (AV:N/AC:L), it is readily automatable once the endpoint is reachable, yielding server-side code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Remote code execution in WookTeam 1.6.6 and earlier lets an attacker inject arbitrary PHP into an eval() call reached through the task export API at /api/project/task/export, granting full server-side code execution. The CVSS 3.1 vector rates the flaw 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), i.e. unauthenticated and network-reachable with total impact, although the assessor cautions that project/task export routes commonly sit behind a login session, so a valid authenticated session or an otherwise exposed/mis-protected route may be the real prerequisite and the PR:N rating should be verified against WookTeam's auth middleware. Publicly available exploit code exists and SSVC rates the attack automatable with total technical impact, while EPSS remains low at 0.15% (4th percentile) - signals conflict on urgency, and overall risk is bounded mainly by WookTeam's limited deployment footprint rather than by exploit difficulty.
RemediationAI
No vendor-released patch is identified in the available intelligence for CVE-2026-88393, so teams running WookTeam 1.6.6 or earlier should treat the code base as unfixed until an upstream release addresses string2array() in app/Module/Base.php (the durable fix is replacing the eval("\$array = $data;") path with a safe parser such as json_decode() or a whitelisted unserialize() with allowed_classes set to false, and removing the 'array'-prefix trigger). Until that lands, the most effective compensating control is to block or disable the /api/project/task/export route at the reverse proxy, WAF, or application router - including any request whose 'data' parameter base64-decodes to a string beginning with 'array' - accepting the trade-off that legitimate task-export functionality is broken for all users. A narrower WAF rule that inspects decoded parameters reduces business impact but can be bypassed with alternate padding/encoding and may generate false positives on large legitimate array payloads. Because the CVSS vector states PR:N but the assessor notes export endpoints are often session-protected, verify that WookTeam's auth middleware actually guards this route and, if it does not, enforce authentication on it immediately; restricting the endpoint to trusted internal networks or to authenticated administrators limits exposure but does not remove the underlying eval() flaw. Monitor web logs for POSTs to /api/project/task/export with unusually long or base64-heavy 'data' values as a detection signal, and apply vendor or project updates as soon as a patched release is published; advisory and PoC detail are at https://github.com/fangtang7/CVE/blob/main/WookTeam/rce.md and https://nvd.nist.gov/vuln/detail/CVE-2026-88393.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-94 (Improper Control of Generation of Code / 'Code Injection') in the PHP application logic of WookTeam. The /api/project/task/export endpoint accepts a 'data' parameter that is base64-decoded and then handed to the string2array() helper in app/Module/Base.php; when the decoded string begins with the literal token 'array', that helper executes eval("\$array = $data;"). Because the value flows into eval() without sanitization or a restrictive parser, an attacker who controls the decoded content can break out of the intended array literal and execute arbitrary PHP in the web server's context. The affected stack is PHP (tags: PHP, RCE, Code Injection) and the SSVC assessment scores the technical impact as total, matching the CVSS impact triad. CPE data supplied for this CVE is an unpopulated placeholder (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*), and the EUVD record likewise lists affected versions as "n/a n/a", so product/version normalization is incomplete in the public feeds and the description's 'v1.6.6 and before' bound is the most reliable scoping statement available.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Single crafted HTTP request to a network API reaches an eval() sink (AV:N/AC:L/UI:N) giving full code execution (C/I/A:H); PR:N retained per input though endpoint auth is unverified.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array() function in app/Module/Base.php, which executes eval("\$array = $data;") whenever the decoded string starts with array. An attacker can inject arbitrary PHP code into the eval call and achieve RCE.
Executive ViewAI
WookTeam 1.6.6 and earlier contain a critical remote code execution flaw in the task export API that could allow an attacker to gain full control of the server hosting the application. Publicly available exploit code exists, and no vendor-released patch identified at time of analysis, so any internet-accessible or weakly segmented WookTeam deployment may expose project data, credentials, and connected systems. Because WookTeam’s deployment footprint is typically limited, leadership should prioritize immediate inventory and containment rather than assume organization-wide impact.
No vendor-released patch identified at time of analysis; interim mitigations include blocking or restricting access to /api/project/task/export, disabling task export if not required, enforcing authentication and authorization on project and task routes, applying WAF or virtual patching rules, and isolating WookTeam 1.6.6 and earlier hosts from untrusted networks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB