A vulnerability has been identified in EGroupware that may lead to Remote Code Execution (RCE). The issue allows an authenticated attacker to execute arbitrary commands on the server. If user self-registration is enabled, the vulnerability may be exploitable without prior authentication. The vulnerability stems from improper authorization checks combined with a file write primitive and an arbitrary file read vulnerability, which together enable full system compromise. This has been patched in versions 26.2.20260224 and 23.1.20260224.

Affected: Packagist: egroupware/egroupware

## Summary A critical vulnerability has been identified in EGroupware that may lead to Remote Code Execution (RCE). The issue allows an authenticated attacker to execute arbitrary commands on the server. If user self-registration is enabled, the vulnerability may be exploitable without prior authentication.

The vulnerability stems from improper authorization checks combined with a file write primitive and an arbitrary file read vulnerability, which together enable full system compromise.

## Details ### 1. Improper Authorization in SmallPartMediaRecorder::ajax_upload()

The vulnerability originates in:

`EGroupware\SmallParT\Widgets\SmallPartMediaRecorder::ajax_upload()`

The function attempts to verify whether the current user is a teacher of the specified course ID before allowing a file upload.

The critical authorization check ensures that the course access control list (ACL) contains:

`$required_acl (self::ROLE_TEACHER, i.e., 3)`

However, the `course_acl `value is derived from user-controlled request data.

**_Bypass Technique_**

A crafted request can manipulate the `participant_role `value inside the request body:

```json { "video": { "course_id": { "participants": [ { "account_id": "7", "name": "Test", "joined_at": "2026-01-10", "participant_role": 3 } ], "account_id": "7", "course_id": "1" }, "video_hash": ".", "video_type": "file_here" } } ```

Because the course…