CVE-2026-27823: EGroupware contains an authorization bypass in SmallPartMediaRecorder::ajax_upload combined with arbitrary file write and file read primitives, enabling authenticated (or self-registered) attackers to overwrite header.inc.php and achieve remote code execution.

A critical vulnerability in EGroupware allows remote code execution by chaining an authorization bypass in EGroupware\SmallParT\Widgets\SmallPartMediaRecorder::ajax_upload() with an arbitrary file write and an arbitrary file read. An attacker can bypass the teacher-role check by supplying a user-controlled participant_role value, then write to a controllable path (e.g., ./header.inc.php). A separate path traversal in importexport_export_ui::download allows reading arbitrary files, enabling the attacker to retrieve and then overwrite a valid header.inc.php with injected PHP code while preserving file structure. RCE occurs after server restart or OPcache expiry. If self-registration is enabled, exploitation may be possible without prior credentials.