CVE-2026-25512

Name of the Vulnerable Software and Affected Versions Group-Office versions prior to 6.8.150 Group-Office versions prior to 25.0.82 Group-Office versions prior to 26.0.5

Description Group-Office is a customer relationship management and groupware tool susceptible to remote code execution (RCE). The /email/message/tnefAttachmentFromTempFile endpoint directly incorporates the user-controlled tmp file parameter into an exec() function call. An authenticated attacker can inject shell metacharacters into the tmp file parameter, enabling the execution of arbitrary system commands on the server.

Recommendations Update Group-Office to version 6.8.150 or later. Update Group-Office to version 25.0.82 or later. Update Group-Office to version 26.0.5 or later.