SQL Injection Vulnerability in EGroupware Web Server Components
CVE-2026-22243

8.7HIGH

Key Information:

Vendor

Egroupware

Status
Egroupware
Vendor
CVE Published:
28 January 2026

What is CVE-2026-22243?

EGroupware is a web-based groupware server built in PHP that has a SQL Injection vulnerability due to improper handling of SQL commands in its core components. This flaw resides in the Nextmatch filter processing, where an authenticated attacker can inject arbitrary SQL commands into the WHERE clause of database queries. The vulnerability is exploited through a PHP type juggling issue resulting from JSON decoding, which allows numeric strings to bypass the is_int() security check. To mitigate this vulnerability, users are advised to update to versions 23.1.20260113 or 26.0.20260113.

Affected Version(s)

egroupware < 23.1.20260113 < 23.1.20260113

egroupware < 26.0.20260113 < 26.0.20260113

References

https://github.com/EGroupware/egroupware/security/advisor...
x_refsource_CONFIRM
https://github.com/EGroupware/egroupware/releases/tag/23....
x_refsource_MISC
https://github.com/EGroupware/egroupware/releases/tag/26....
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.