Read the docs
TI-2023-25213 Aliases CVE-2023-46730

Server-Side Request Forgery in groupoffice

Priority HIGH 73CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Group-Office is an enterprise CRM and groupware tool. In affected versions there is full Server-Side Request Forgery (SSRF) vulnerability in the /api/upload.php endpoint. The /api/upload.php endpoint does not filter URLs which allows a malicious user to cause the server to make resource requests to untrusted domains. Note that protocols like file:// can also be used to access the server disk. The request result (on success) can then be retrieved using /api/download.php. This issue has been addressed in versions 6.8.15, 6.7.54, and 6.6.177. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00595 48th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed groupoffice (Intermesh): 6.6.177, 6.7.54, 6.8.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Intermeshgroupoffice6.3.0 to before 6.6.177; 6.7.0 to before 6.7.54; 6.8.0 to before 6.8.156.6.177, 6.7.54, 6.8.15Patch availableCNA
  • groupoffice VendorIntermesh Affected 6.3.0 to before 6.6.177; 6.7.0 to before 6.7.54; 6.8.0 to before 6.8.15 Fixed in 6.6.177, 6.7.54, 6.8.15 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:group-office:group_office:*:*:*:*:*:*:*:*6.3.1 to before 6.6.177; 6.7.0 to before 6.7.54; 6.8.0 to before 6.8.15VulnerableGroup-office
  • cpe:2.3:a:group-office:group_office:*:*:*:*:*:*:*:* Versions 6.3.1 to before 6.6.177; 6.7.0 to before 6.7.54; 6.8.0 to before 6.8.15 Vulnerable ·Group-office

Remediation

  • Fix · CNA groupoffice (Intermesh) Fixed in 6.6.177, 6.7.54, 6.8.15

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-46730

References

Exploit 1

Patch 1

  • TI-2026-20622 Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler CVSS 4.0CRITICAL 9.4
  • TI-2018-16194 Path traversal in Intermesh Group-Office lets attackers read files CVSS 4.0HIGH 8.7
  • TI-2026-20621 Group-Office is vulnerable to SSRF and File Read in WOPI service discovery CVSS 4.0HIGH 8.2
  • TI-2025-30692 GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions CVSS 4.0MEDIUM 6.9
  • TI-2025-18860 Group-Office has a Stored XSS Vulnerability via user's name field CVSS 4.0MEDIUM 6.9
  • TI-2025-30694 GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution CVSS 4.0MEDIUM 5.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences