In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (".xet") to the VFS "/etemplates" mount. The "Widget::expand_name()" method passes template widget attribute values directly into a PHP "eval()" call with only double-quote escaping applied - backtick characters are not escaped. In PHP, backticks inside a double-quoted "eval()" string execute shell commands. This allows an admin-level user to escalate from web application access to arbitrary OS command execution on the server.