EIP-2026-109590

The vulnerability in moregroupware allows remote attackers to execute arbitrary PHP code by manipulating the include path via the 'webmail2_inc_dir' parameter. This is a remote file inclusion (RFI) vulnerability that can lead to remote code execution (RCE) under certain PHP configurations.