CVE-2026-40187

In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution RCE by uploading a malicious eTemplate XML file ".xet" to the VFS "/etemplates" mount. The "Widget::expandname" method passes template widget attribute values directly into a PHP "eva...