CVE-2026-125390

Name of the Vulnerable Software and Affected Versions Group-Office versions prior to 6.8.181 Group-Office versions prior to 25.0.116 Group-Office versions prior to 26.0.58

Description An arbitrary local file read issue exists in the actionProcessUploadQueue() function of the FolderController. Authenticated users can read server files by providing absolute paths within the blobs parameter. This allows attackers to hard-link or copy files into their own folders for download, potentially exposing other users' stored files and database credentials located in config.php.

Recommendations Update to version 6.8.181 or later. Update to version 25.0.116 or later. Update to version 26.0.58 or later.