{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "egroupware/egroupware"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "26.0.20251208"
            },
            {
              "fixed": "26.5.20260507"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "egroupware/egroupware"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "23.1.20260601"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45016"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-07T13:02:43Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe function processes image URLs embedded in an HTML email body without validating or restricting URI schemes. The check `!str_starts_with($myUrl, \u0027http\u0027)` evaluates to true for `file://` URIs, causing `file_get_contents($basedir . urldecode($myUrl))` to read arbitrary files from the server filesystem and embed them as inline MIME attachments in outgoing email.\n\nstr_starts_with(\u0027file:///etc/passwd\u0027, \u0027http\u0027) \u2192 **false**\n!false \u2192 **true**\n\n\n```php\n// api/src/Mail.php  \nforeach($images[2] as $i =\u003e $url)\n\t\t\t{\n\t\t\t\t//$isData = false;\n\t\t\t\t$basedir = $data = \u0027\u0027;\n\t\t\t\t$needTempFile = true;\n\t\t\t\t$attachmentData = [\u0027name\u0027 =\u003e \u0027\u0027, \u0027type\u0027 =\u003e \u0027\u0027, \u0027file\u0027 =\u003e \u0027\u0027, \u0027tmp_name\u0027 =\u003e \u0027\u0027];\n\t\t\t\ttry\n\t\t\t\t{\n\t\t\t\t\t// do not change urls for absolute images (thanks to corvuscorax)\n\t\t\t\t\tif (!str_starts_with($url, \u0027data:\u0027))\n\t\t\t\t\t{\n\t\t\t\t\t\t$attachmentData[\u0027name\u0027] = basename($url); // need to resolve all sort of url\n\t\t\t\t\t\tif (($directory = dirname($url)) == \u0027.\u0027) $directory = \u0027\u0027;\n\t\t\t\t\t\t$ext = pathinfo($attachmentData[\u0027name\u0027], PATHINFO_EXTENSION);\n\t\t\t\t\t\t$attachmentData[\u0027type\u0027] = MimeMagic::ext2mime($ext);\n\t\t\t\t\t\tif ( strlen($directory) \u003e 1 \u0026\u0026 !str_ends_with($directory, \u0027/\u0027)) { $directory .= \u0027/\u0027; }\n..\n...\n....\n// processURL2InlineImages function\nif ( $myUrl[0]!=\u0027/\u0027 \u0026\u0026 strlen($basedir) \u003e 1 \u0026\u0026 !str_ends_with($basedir, \u0027/\u0027)) { $basedir .= \u0027/\u0027; }\n\t\t\t\t\t\tif ($needTempFile \u0026\u0026 empty($attachment) \u0026\u0026 !str_starts_with($myUrl, \"http\"))\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\t\t$data = file_get_contents($basedir.urldecode($myUrl));\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tcatch (\\Throwable $e) {\n\t\t\t\t\t\t\t\t_egw_log_exception($e);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tif (str_starts_with($url, \u0027data:\u0027))\n```\n\n### PoC\n1. Log in as any authenticated EGroupware user with mail access and open the mail compose window.\n2. Switch to HTML body mode and insert: `\u003cimg src=\"file:///etc/passwd\"\u003e`. \n3. The server executes file_get_contents(\u0027file:///etc/passwd\u0027), writes the content to a temp file, and attaches it as an inline MIME part. \n\n\n### Impact\nAn authenticated attacker can read arbitrary files accessible by the web server process, including /etc/passwd, application configuration files containing database credentials, private TLS keys, and environment files.\n\n\n### Remediation\nEnforce a strict URI scheme allowlist before calling file_get_contents(). Replace the check `!str_starts_with($myUrl, \u0027http\u0027)` with `if (!preg_match(\u0027#^https?://#i\u0027, $myUrl)) { continue; }` to reject `file://`, `ftp://`, `php://`, `data://`, and any other non-HTTP scheme.",
  "id": "GHSA-c8m7-r2jv-rw63",
  "modified": "2026-07-07T13:02:43Z",
  "published": "2026-07-07T13:02:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/EGroupware/egroupware/security/advisories/GHSA-c8m7-r2jv-rw63"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/EGroupware/egroupware"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose"
}