EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose

Summary

The function processes image URLs embedded in an HTML email body without validating or restricting URI schemes. The check !str_starts_with($myUrl, 'http') evaluates to true for file:// URIs, causing file_get_contents($basedir . urldecode($myUrl)) to read arbitrary files from the server filesystem and embed them as inline MIME attachments in outgoing email.

str_starts_with('file:///etc/passwd', 'http') → false
!false → true

 1// api/src/Mail.php  
 2foreach($images[2] as $i => $url)
 3			{
 4				//$isData = false;
 5				$basedir = $data = '';
 6				$needTempFile = true;
 7				$attachmentData = ['name' => '', 'type' => '', 'file' => '', 'tmp_name' => ''];
 8				try
 9				{
10					// do not change urls for absolute images (thanks to corvuscorax)
11					if (!str_starts_with($url, 'data:'))
12					{
13						$attachmentData['name'] = basename($url); // need to resolve all sort of url
14						if (($directory = dirname($url)) == '.') $directory = '';
15						$ext = pathinfo($attachmentData['name'], PATHINFO_EXTENSION);
16						$attachmentData['type'] = MimeMagic::ext2mime($ext);
17						if ( strlen($directory) > 1 && !str_ends_with($directory, '/')) { $directory .= '/'; }
18..
19...
20....
21// processURL2InlineImages function
22if ( $myUrl[0]!='/' && strlen($basedir) > 1 && !str_ends_with($basedir, '/')) { $basedir .= '/'; }
23						if ($needTempFile && empty($attachment) && !str_starts_with($myUrl, "http"))
24						{
25							try {
26								$data = file_get_contents($basedir.urldecode($myUrl));
27							}
28							catch (\Throwable $e) {
29								_egw_log_exception($e);
30							}
31						}
32					}
33					if (str_starts_with($url, 'data:'))

PoC

1. Log in as any authenticated EGroupware user with mail access and open the mail compose window.
2. Switch to HTML body mode and insert: <img src="file:///etc/passwd">.
3. The server executes file_get_contents('file:///etc/passwd'), writes the content to a temp file, and attaches it as an inline MIME part.

Impact

An authenticated attacker can read arbitrary files accessible by the web server process, including /etc/passwd, application configuration files containing database credentials, private TLS keys, and environment files.

Remediation

Enforce a strict URI scheme allowlist before calling file_get_contents(). Replace the check !str_starts_with($myUrl, 'http') with if (!preg_match('#^https?://#i', $myUrl)) { continue; } to reject file://, ftp://, php://, data://, and any other non-HTTP scheme.