CVE-2026-88393: WookTeam WookTeam vulnerability
Published Oct 5, 2026
·Updated
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array() function in app/Module/Base.php, which executes eval("\$array = $data;") whenever the decoded string starts with array. An attacker can inject arbitrary PHP code into the eval call and achieve RCE.
Affected Software
1 affected component
WookTeam WookTeam<=1.6.6
Event History
Oct 5, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What does an attacker need to control to exploit this issue?
The attacker needs to submit a crafted base64-encoded value through the data parameter of the /api/project/task/export interface. After decoding, the value must begin with array so that it reaches the eval call in string2array().