EUVD-2026-92470

WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array function in app/Module/Base.php, which executes eval"$array = $data;" whenever the decoded string starts...

CVE-2026-88393

WookTeam versions v1.6.6 and before are vulnerable to Remote Code Execution (RCE) within the project task export interface at /api/project/task/export . The root cause is located in the string2array() function in app/Module/Base.php , where the data parameter is base64-decoded and passed into an ...