### Summary The function processes image URLs embedded in an HTML email body without validating or restricting URI schemes. The check `!str_starts_with($myUrl, 'http')` evaluates to true for `file://` URIs, causing `file_get_contents($basedir . urldecode($myUrl))` to read arbitrary files from the server filesystem and embed them as inline MIME attachments in outgoing email. str_starts_with('file:///etc/passwd', 'http') → **false** !false → **true** ```php // api/src/Mail.php foreach($images[2] as $i => $url) { //$isData = false; $basedir = $data = ''; $needTempFile = true; $attachmentData = ['name' => '', 'type' => '', 'file' => '', 'tmp_name' => '']; try { // do not change urls for absolute images (thanks to corvuscorax) if (!str_starts_with($url, 'data:')) { $attachmentData['name'] = basename($url); // need to resolve all sort of url if (($directory = dirname($url)) == '.') $directory = ''; $ext = pathinfo($attachmentData['name'], PATHINFO_EXTENSION); $attachmentData['type'] = MimeMagic::ext2mime($ext); if ( strlen($directory) > 1 && !str_ends_with($directory, '/')) { $directory .= '/'; } .. ... .... // processURL2InlineImages function if ( $myUrl[0]!='/' && strlen($basedir) > 1 && !str_ends_with($basedir, '/')) { $basedir .= '/'; } if ($needTempFile && empty($attachment) && !str_starts_with($myUrl, "http")) { try { $data = file_get_contents($basedir.urldecode($myUrl)); } catch (\Throwable $e) { _egw_log_exception($e); } } } if (str_starts_with($url, 'data:')) ``` ### PoC 1. Log in as any authenticated EGroupware user with mail access and open the mail compose window. 2. Switch to HTML body mode and insert: `<img src="file:///etc/passwd">`. 3. The server executes file_get_contents('file:///etc/passwd'), writes the content to a temp file, and attaches it as an inline MIME part. ### Impact An authenticated attacker can read arbitrary files accessible by the web server process, including /etc/passwd, application configuration files containing database credentials, private TLS keys, and environment files. ### Remediation Enforce a strict URI scheme allowlist before calling file_get_contents(). Replace the check `!str_starts_with($myUrl, 'http')` with `if (!preg_match('#^https?://#i', $myUrl)) { continue; }` to reject `file://`, `ftp://`, `php://`, `data://`, and any other non-HTTP scheme.
### Summary The function processes image URLs embedded in an HTML email body without validating or restricting URI schemes. The check `!str_starts_with($myUrl, 'http')` evaluates to true for `file://` URIs, causing `file_get_contents($basedir . urldecode($myUrl))` to read arbitrary files from the server filesystem and embed them as inline MIME attachments in outgoing email. str_starts_with('file:///etc/passwd', 'http') → **false** !false → **true** ```php // api/src/Mail.php foreach($images[2] as $i => $url) { //$isData = false; $basedir = $data = ''; $needTempFile = true; $attachmentData = ['name' => '', 'type' => '', 'file' => '', 'tmp_name' => '']; try { // do not change urls for absolute images (thanks to corvuscorax) if (!str_starts_with($url, 'data:')) { $attachmentData['name'] = basename($url); // need to resolve all sort of url if (($directory = dirname($url)) == '.') $directory = ''; $ext = pathinfo($attachmentData['name'], PATHINFO_EXTENSION); $attachmentData['type'] = MimeMagic::ext2mime($ext); if ( strlen($directory) > 1 && !str_ends_with($directory, '/')) { $directory .= '/'; } .. ... .... // processURL2InlineImages function if ( $myUrl[0]!='/' && strlen($basedir) > 1 && !str_ends_with($basedir, '/')) { $basedir .= '/'; } if ($needTempFile && empty($attachment) && !str_starts_with($myUrl, "http")) { try { $data = file_get_contents($basedir.urldecode($myUrl)); } catch (\Throwable $e) { _egw_log_exception($e); } } } if (str_starts_with($url, 'data:')) ``` ### PoC 1. Log in as any authenticated EGroupware user with mail access and open the mail compose window. 2. Switch to HTML body mode and insert: `<img src="file:///etc/passwd">`. 3. The server executes file_get_contents('file:///etc/passwd'), writes the content to a temp file, and attaches it as an inline MIME part. ### Impact An authenticated attacker can read arbitrary files accessible by the web server process, including /etc/passwd, application configuration files containing database credentials, private TLS keys, and environment files. ### Remediation Enforce a strict URI scheme allowlist before calling file_get_contents(). Replace the check `!str_starts_with($myUrl, 'http')` with `if (!preg_match('#^https?://#i', $myUrl)) { continue; }` to reject `file://`, `ftp://`, `php://`, `data://`, and any other non-HTTP scheme.
Update egroupware/egroupware to 26.5.20260507; egroupware/egroupware to 23.1.20260601 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanEGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose affects egroupware/egroupware (composer), egroupware/egroupware (composer). Severity is medium. ### Summary The function processes image URLs embedded in an HTML email body without validating or restricting URI schemes. The check `!str_starts_with($myUrl, 'http')` evaluates to true for `file://` URIs, causing `file_get_contents($basedir . urldecode($myUrl))` to read arbitrary files from the server filesystem and embed them as inline MIME attachments in outgoing email. str_starts_with('file:///etc/passwd', 'http') → **false** !false → **true** ```php // api/src/Mail.php foreach($images[2] as $i => $url) { //$isData = false; $basedir = $data = ''; $needTempFile = true; $attachmentData = ['name' => '', 'type' => '', 'file' => '', 'tmp_name' => '']; try { // do not change urls for absolute images (thanks to corvuscorax) if (!str_starts_with($url, 'data:')) { $attachmentData['name'] = basename($url); // need to resolve all sort of url if (($directory = dirname($url)) == '.') $directory = ''; $ext = pathinfo($attachmentData['name'], PATHINFO_EXTENSION); $attachmentData['type'] = MimeMagic::ext2mime($ext); if ( strlen($directory) > 1 && !str_ends_with($directory, '/')) { $directory .= '/'; } .. ... .... // processURL2InlineImages function if ( $myUrl[0]!='/' && strlen($basedir) > 1 && !str_ends_with($basedir, '/')) { $basedir .= '/'; } if ($needTempFile && empty($attachment) && !str_starts_with($myUrl, "http")) { try { $data = file_get_contents($basedir.urldecode($myUrl)); } catch (\Throwable $e) { _egw_log_exception($e); } } } if (str_starts_with($url, 'data:')) ``` ### PoC 1. Log in as any authenticated EGroupware user with mail access and open the mail compose window. 2. Switch to HTML body mode and insert: `<img src="file:///etc/passwd">`. 3. The server executes file_get_contents('file:///etc/passwd'), writes the content to a temp file, and attaches it as an inline MIME part. ### Impact An authenticated attacker can read arbitrary files accessible by the web server process, including /etc/passwd, application configuration files containing database credentials, private TLS keys, and environment files. ### Remediation Enforce a strict URI scheme allowlist before calling file_get_contents(). Replace the check `!str_starts_with($myUrl, 'http')` with `if (!preg_match('#^https?://#i', $myUrl)) { continue; }` to reject `file://`, `ftp://`, `php://`, `data://`, and any other non-HTTP scheme.
AI coding agents often install or upgrade packages automatically in composer. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| egroupware/egroupwarecomposer | >=26.0.20251208,<26.5.20260507 | 26.5.20260507 |
| egroupware/egroupwarecomposer | <23.1.20260601 | 23.1.20260601 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate egroupware/egroupware to 26.5.20260507; egroupware/egroupware to 23.1.20260601 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanEGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose affects egroupware/egroupware (composer), egroupware/egroupware (composer). Severity is medium. ### Summary The function processes image URLs embedded in an HTML email body without validating or restricting URI schemes. The check `!str_starts_with($myUrl, 'http')` evaluates to true for `file://` URIs, causing `file_get_contents($basedir . urldecode($myUrl))` to read arbitrary files from the server filesystem and embed them as inline MIME attachments in outgoing email. str_starts_with('file:///etc/passwd', 'http') → **false** !false → **true** ```php // api/src/Mail.php foreach($images[2] as $i => $url) { //$isData = false; $basedir = $data = ''; $needTempFile = true; $attachmentData = ['name' => '', 'type' => '', 'file' => '', 'tmp_name' => '']; try { // do not change urls for absolute images (thanks to corvuscorax) if (!str_starts_with($url, 'data:')) { $attachmentData['name'] = basename($url); // need to resolve all sort of url if (($directory = dirname($url)) == '.') $directory = ''; $ext = pathinfo($attachmentData['name'], PATHINFO_EXTENSION); $attachmentData['type'] = MimeMagic::ext2mime($ext); if ( strlen($directory) > 1 && !str_ends_with($directory, '/')) { $directory .= '/'; } .. ... .... // processURL2InlineImages function if ( $myUrl[0]!='/' && strlen($basedir) > 1 && !str_ends_with($basedir, '/')) { $basedir .= '/'; } if ($needTempFile && empty($attachment) && !str_starts_with($myUrl, "http")) { try { $data = file_get_contents($basedir.urldecode($myUrl)); } catch (\Throwable $e) { _egw_log_exception($e); } } } if (str_starts_with($url, 'data:')) ``` ### PoC 1. Log in as any authenticated EGroupware user with mail access and open the mail compose window. 2. Switch to HTML body mode and insert: `<img src="file:///etc/passwd">`. 3. The server executes file_get_contents('file:///etc/passwd'), writes the content to a temp file, and attaches it as an inline MIME part. ### Impact An authenticated attacker can read arbitrary files accessible by the web server process, including /etc/passwd, application configuration files containing database credentials, private TLS keys, and environment files. ### Remediation Enforce a strict URI scheme allowlist before calling file_get_contents(). Replace the check `!str_starts_with($myUrl, 'http')` with `if (!preg_match('#^https?://#i', $myUrl)) { continue; }` to reject `file://`, `ftp://`, `php://`, `data://`, and any other non-HTTP scheme.
AI coding agents often install or upgrade packages automatically in composer. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| egroupware/egroupwarecomposer | >=26.0.20251208,<26.5.20260507 | 26.5.20260507 |
| egroupware/egroupwarecomposer | <23.1.20260601 | 23.1.20260601 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard