CVE-2026-25512
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, there is a remote code execution (RCE) vulnerability in Group-Office. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmpfile into an exec() call. By injecting shell metacharacters into tmpfile, an authenticated attacker can execute arbitrary system commands on the server. This issue has been patched in versions 6.8.150, 25.0.82, and 26.0.5.
Package Versions Affected
Automatically patch vulnerabilities without upgrading
CVSS Version



Related Resources
References
http://github.com/Intermesh/groupoffice/commit/6c612deca97a6cd2a1bd4feea0ce7e8e9d907792, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25512.json, https://github.com/Intermesh/groupoffice/security/advisories/GHSA-579w-jvg7-frr4, https://nvd.nist.gov/vuln/detail/CVE-2026-25512
