CVE-2026-63011

Name of the Vulnerable Software and Affected Versions Group-Office versions prior to 6.8.167 Group-Office versions prior to 25.0.102 Group-Office versions prior to 26.0.27

Description An authenticated user can execute arbitrary operating system commands as the web server user (www-data) via a single HTTP request. The issue exists in the Contact/labels JMAP endpoint, which accepts a template string through the tpl parameter and passes it to the TemplateParser::parse() function. When the template includes an [assign] block with a {{...}} variable reference, the engine executes eval() on the expanded expression. Although a validateExpression() guard is used, PHP 7+ allows strings enclosed in parentheses to be invoked as functions, bypassing the guard and enabling remote code execution.

Recommendations Update to version 6.8.167. Update to version 25.0.102. Update to version 26.0.27.