In EGroupware versions 26.0 and prior, an authenticated administrator can upload a malicious .xet XML file to the VFS /etemplates directory. The Widget::expand_name method inserts the file content directly into a PHP eval call with only double‑quote escaping, leaving backtick characters unescaped. In PHP, backticks execute shell commands, so the attacker can invoke arbitrary commands on the host. This is an OS‑level Remote Code Execution flaw that exploits CWE‑78 (OS Command Injection) and CWE‑95 (Eval Injection).

The vulnerability is present in the EGroupware product (EGroupware:egroupware) for all releases 26.0 and older. Any deployment running those versions where administrators retain write permissions to the /etemplates VFS mount is affected; this includes installations that allow administrators to freely upload eTemplates.

The CVSS score of 8.6 indicates high severity, while the EPSS score of <1% suggests a low probability of exploitation at present, and the defect is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need authenticated administrator access to upload a crafted eTemplate. Once uploaded, the evaluated code triggers backtick shell execution, granting the attacker full control over the operating system from the web application layer.