EGroupware has SQL Injection in Nextmatch Filter Processing
Date: 2026-01
Affected: composer/egroupware/egroupware, composer/egroupware/egroupware
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-22243
CWE: CWE-89

### Summary **Critical Authenticated SQL Injection in Nextmatch Widget Filter Processing** A critical SQL Injection vulnerability exists in the core components of EGroupware, specifically in the `Nextmatch` filter processing. The flaw allows authenticated attackers to inject arbitrary SQL commands into the `WHERE` clause of database queries. This is achieved by exploiting a PHP type juggling issue where JSON decoding converts numeric strings into integers, bypassing the `is_int()` security check used by the application. ### Details **Root Cause Analysis** The vulnerability exists in how the database abstraction layer (`Api\Db`) and high-level storage classes (`Api\Storage\Base`, `infolog_so`) process the `col_filter` array used in "Nextmatch" widgets. The application attempts to validate input using `is_int($key)` to determine if an array key represents a raw SQL fragment that should be trusted. However, when processing JSON-based POST requests, PHP's `json_decode` automatically converts numeric string keys (e.g., `"0"`) into native integers. Consequently, an attacker can send a JSON payload with an associative array containing numeric keys. The application interprets these keys as integers (`is_int` returns true) and blindly appends the associated values - containing malicious SQL - directly to the query. **Vulnerable Code Locations** 1. **File:** `sources/egroupware/api/src/Db.php` (Approx. Line 1776) Method: `column_data_implode` ```php // In function column_data


Mitigations:

Architectural layers (MAESTRO):