CVE-2026-88393 in WookTeam
Summary
by MITRE • 10/05/2026
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array() function in app/Module/Base.php, which executes eval("\$array = $data;") whenever the decoded string starts with array. An attacker can inject arbitrary PHP code into the eval call and achieve RCE.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in WookTeam versions 1.6.6 and earlier represents a critical Remote Code Execution (RCE) flaw located within the project task export functionality, specifically targeting the /api/project/task/export endpoint. This security issue stems from improper input validation and unsafe deserialization practices inherent in how the application processes user-supplied data for exporting tasks. The core of the vulnerability lies in the handling of the data parameter sent to this API endpoint. Upon receipt, the system performs a base64 decoding operation on the provided input without sufficient sanitization or type checking before passing it further into internal processing functions. This lack of rigorous validation allows an attacker to manipulate the payload structure significantly more easily than if raw arbitrary strings were required, as base64 encoding is trivially reversible and commonly used in exploit delivery mechanisms.
The technical mechanism of exploitation involves injecting a specially crafted string that, once decoded from its base64 representation, begins with the literal text array followed by malicious PHP code. This manipulated payload is then passed directly into the string2array() function defined within app/Module/Base.php. The critical failure occurs because this internal function does not merely parse the input as data; instead, it dynamically constructs and executes a PHP eval statement using the format eval("\$array = $data;"). When the injected data starts with array( or similar valid syntax that allows for code execution after assignment, the semicolon terminates the variable assignment, allowing any subsequent PHP code within the string to be executed by the interpreter. This effectively bypasses standard security controls and grants the attacker full command-line equivalent capabilities on the server hosting the WookTeam instance.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and specifically CWE-501 Trust Boundary Violation, as the application fails to properly validate untrusted input before using it in a security-critical context. In terms of offensive cybersecurity frameworks such as MITRE ATT&CK, this behavior is indicative of T1059 Command and Scripting Interpreter abuse, where an attacker leverages system utilities like PHP eval() to execute arbitrary commands. The ability to achieve RCE through this vector means that the confidentiality, integrity, and availability of the entire WookTeam environment are compromised. An adversary could potentially exfiltrate sensitive project data, modify existing tasks or user accounts, install persistent backdoors, or pivot further into the internal network depending on the privileges under which the web server process operates.
The operational impact of this vulnerability is severe due to its remote nature and lack of authentication requirements in some configurations, although typically API endpoints require valid session tokens. If an attacker obtains a legitimate user token with access to project tasks, they can exploit this flaw without needing additional privilege escalation steps initially. The consequences extend beyond immediate code execution; the persistence established through RCE allows for long-term unauthorized access and data theft. Furthermore, because the vulnerability resides in a core module handling task exports, it may affect multiple users within an organization who utilize this feature, increasing the attack surface significantly across all active projects managed by WookTeam instances running affected versions.
Mitigation strategies must prioritize immediate patching to version 1.6.7 or later where these issues have been addressed through stricter input validation and removal of unsafe eval usage in favor of safer data parsing methods such as json_decode with appropriate type checking. In the interim, organizations should implement Web Application Firewall rules that detect base64-encoded payloads containing PHP array syntax followed by semicolons and subsequent code execution patterns targeting the /api/project/task/export endpoint. Additionally, restricting API access to only necessary IP ranges or enforcing multi-factor authentication can reduce the likelihood of successful exploitation. Developers must also conduct a thorough audit of other endpoints for similar unsafe deserialization practices, ensuring that all user inputs are strictly typed and validated against expected formats before being processed by any dynamic code execution functions.