TI-2026-20622 Aliases CVE-2026-25512

Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler

HIGH 82CWE-78Published 2026-02-04 · Updated 2026-02-05

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, there is a remote code execution (RCE) vulnerability in Group-Office. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmp_file into an exec() call. By injecting shell metacharacters into tmp_file, an authenticated attacker can execute arbitrary system commands on the server. This issue has been patched in versions 6.8.150, 25.0.82, and 26.0.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.1986 97th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed groupoffice (Intermesh): 6.8.150, 25.0.82, 26.0.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Intermesh	groupoffice	before 6.8.150; before 25.0.82; before 26.0.5	6.8.150, 25.0.82, 26.0.5	Patch available	CNA

groupoffice VendorIntermesh Affected before 6.8.150; before 25.0.82; before 26.0.5 Fixed in 6.8.150, 25.0.82, 26.0.5 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:group-office:group_office::::::::	before 6.8.150; 25.0.1 to before 25.0.82; 26.0.1 to before 26.0.5	Vulnerable	Group-office

cpe:2.3:a:group-office:group_office:*:*:*:*:*:*:*:* Versions before 6.8.150; 25.0.1 to before 25.0.82; 26.0.1 to before 26.0.5 Vulnerable ·Group-office

Remediation

Fix · CNA groupoffice (Intermesh) Fixed in 6.8.150, 25.0.82, 26.0.5

Timeline

2026-10-02 Threatist record created from CVE-2026-25512
2026-10-23 EPSS moved to the 90th–95th percentile
2026-10-25 EPSS moved to the 95th–99th percentile

References

Exploit 1

https://github.com/Intermesh/groupoffice/security/advisories/GHSA-579w-jvg7-frr4

Patch 1

http://github.com/Intermesh/groupoffice/commit/6c612deca97a6cd2a1bd4feea0ce7e8e9d907792

TI-2018-16194 Path traversal in Intermesh Group-Office lets attackers read files CVSS 4.0HIGH 8.7
TI-2026-20621 Group-Office is vulnerable to SSRF and File Read in WOPI service discovery CVSS 4.0HIGH 8.2
TI-2023-25213 Server-Side Request Forgery in groupoffice CVSS 3.1HIGH 8.8
TI-2025-30692 GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions CVSS 4.0MEDIUM 6.9
TI-2025-18860 Group-Office has a Stored XSS Vulnerability via user's name field CVSS 4.0MEDIUM 6.9
TI-2025-30694 GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution CVSS 4.0MEDIUM 5.8

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences