TI-2026-27082 Aliases CVE-2026-34838

Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`

MEDIUM 45CWE-502Published 2026-04-02 · Updated 2026-04-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.156, 25.0.90, and 26.0.12, a vulnerability in the AbstractSettingsCollection model leads to insecure deserialization when these settings are loaded. By injecting a serialized FileCookieJar object into a setting string, an authenticated attacker can achieve Arbitrary File Write, leading directly to Remote Code Execution (RCE) on the server. This issue has been patched in versions 6.8.156, 25.0.90, and 26.0.12.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01042 64th percentileScored 2026-11-07

Fix Fixed groupoffice (Intermesh): 6.8.156, 25.0.90, 26.0.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Intermesh	groupoffice	before 6.8.156; before 25.0.90; before 26.0.12	6.8.156, 25.0.90, 26.0.12	Patch available	CNA

groupoffice VendorIntermesh Affected before 6.8.156; before 25.0.90; before 26.0.12 Fixed in 6.8.156, 25.0.90, 26.0.12 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:intermesh:group-office::::::::	before 6.8.156; 25.0.1 to before 25.0.90; 26.0.1 to before 26.0.12	Vulnerable	Intermesh

cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:* Versions before 6.8.156; 25.0.1 to before 25.0.90; 26.0.1 to before 26.0.12 Vulnerable ·Intermesh

Remediation

Fix · CNA groupoffice (Intermesh) Fixed in 6.8.156, 25.0.90, 26.0.12

Timeline

2026-10-02 Threatist record created from CVE-2026-34838

References

Advisory 1

https://github.com/Intermesh/groupoffice/security/advisories/GHSA-h22j-frrf-5vxq

Other 3

TI-2025-30692 GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions CVSS 4.0MEDIUM 6.9
TI-2025-30694 GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution CVSS 4.0MEDIUM 5.8
TI-2025-31121 Group-Office vulnerable to reflected XSS via Look and Feel Formatting input CVSS 4.0MEDIUM 5.3
TI-2025-31120 Group-Office vulnerable to blind XSS CVSS 4.0MEDIUM 5.2
TI-2025-30695 GroupOffice vulnerable to Stored XSS in Tasks Comment Section CVSS 4.0MEDIUM 5.3
TI-2026-23471 Group-Office: Reflected XSS in JavaScript context CVSS 4.0MEDIUM 5.1

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences