# EGroupware has Authenticated RCE via Malicious eTemplate Upload

Admin-uploaded eTemplate .xet widget id with backticks reaches eval() in Widget::expand_name(), executing shell commands as the web server user.

- Payout: Research
- Severity: high
- Program: EGroupware
- Found by: dapickle
- Disclosed: 2026-07-07
- CVE: CVE-2026-40187
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-8737-2x9g-xjj7
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-8737-2x9g-xjj7
- Tags: area:web domain:web impact:privesc impact:rce kind:research platform:ghsa sev:high tech:php technique:source-review vuln:command-injection vuln:file-upload vuln:rce

**Target:** PHP web app eTemplate widget attribute expansion (api/src/Etemplate/Widget.php)
**Root cause:** Widget::expand_name() interpolates widget attribute values into a double-quoted eval() string escaping only double quotes, leaving backticks (shell_exec) unescaped.
**Steps:**
1. Log in as admin, go to Admin → Filemanager → VFS Mounts and click 'Install custom templates' to mount /etemplates with Admins rwx.
2. Upload `index.xet` to `/etemplates/admin/templates/default/index.xet` containing a textbox with `id="$row`touch /tmp/pwned_egw 2>/dev/null`"`.
3. Visit `https://<target>/egroupware/index.php?menuaction=admin.admin_ui.index` to load the template.
4. form_name() calls expand_name() producing `eval('$name = "$row`touch /tmp/pwned_egw 2>/dev/null`";');` which runs the shell command.
5. Verify `/tmp/pwned_egw` exists; swap payload for `id > /tmp/pwned_egw` to capture the web user.
**How found:** Code review of Widget::expand_name() noting eval() gated on `$` with only double-quote escaping, and that backticks in double-quoted PHP strings invoke shell_exec; combined with /etemplates being admin-writable and taking precedence over built-in templates.
**Exploitation:** Requires admin session and a deployment without disable_functions blocking shell_exec (non-Docker or unhardened). Malicious template in /etemplates overrides built-in templates; loading the admin index triggers eval of the backtick payload, executing commands as www-data, enabling config/DB credential theft, pivoting and persistence.
**Escalation:** Admin web access escalates to OS command execution as the web server user; from there read configs, pivot, persist.
**Insight:** When a sink escapes only one quote style before eval(), enumerate every other interpolation/execution metacharacter (backticks, ${}, heredoc) — and check whether an admin-writable VFS mount can shadow trusted template/config files.

## Proof of concept (copied exactly from the original report)

**Trigger URL for admin panel template load**

```
https://<target>/egroupware/index.php?menuaction=admin.admin_ui.index
```

**eval backtick injection example**

```
eval('$name = "$row`id`";');  // executes shell command: id
```