Description
phpgwapi/js/fckeditor/editor/dialog/fck_spellerpages/spellerpages/serverscripts/spellchecker.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) aspell_path or (2) spellchecker_lang parameters.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | egroupware | 1.4.004-2.dfsg-4.2 | DSA-2013-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- eGroupWare 1.6.002 and eGroupWare premium line 9.1 - Multiple Vulnerabilities EDB-11777 · webapps · Mar 16, 2010 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | egroupware/egroupware | < 1.6.003 | 1.6.003 | GHSA-5gx6-f2qq-475f |
| Packagist | egroupware/egroupware | >= 9.1, < 9.1.20100309 | 9.1.20100309 | GHSA-5gx6-f2qq-475f |
| Packagist | egroupware/egroupware | >= 9.2, < 9.2.20100309 | 9.2.20100309 | GHSA-5gx6-f2qq-475f |
Advisories 1
- DSA-2013-1 egroupware - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 11777 exploit
- http://www.egroupware.org/news?item=93
- DSA-2013 vendor-advisory
- [oss-security] 20100921 Re: CVE request: egroupware remote code and xss mailing-list