CVE-2026-22243

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-22243
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22243.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-22243
Aliases
Published
2026-01-28T16:05:35.641Z
Modified
2026-01-30T22:53:08.544889Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
EGroupware has SQL Injection in Nextmatch Filter Processing
Details

EGroupware is a Web based groupware server written in PHP. A SQL Injection vulnerability exists in the core components of EGroupware prior to versions 23.1.20260113 and 26.0.20260113, specifically in the Nextmatch filter processing. The flaw allows authenticated attackers to inject arbitrary SQL commands into the WHERE clause of database queries. This is achieved by exploiting a PHP type juggling issue where JSON decoding converts numeric strings into integers, bypassing the is_int() security check used by the application. Versions 23.1.20260113 and 26.0.20260113 patch the vulnerability.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22243.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ]
}
References

Affected packages

Git / github.com/egroupware/egroupware

Affected ranges

Type
GIT
Repo
https://github.com/egroupware/egroupware
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
dd32c4f5fadcc0fcc17a4c64233492143ecd2a40

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22243.json"