CVE-2026-25512 Scanner

Group-Office is a comprehensive groupware application designed primarily for enterprises, making it ideal for business communication and project management. It is widely implemented by organizations to streamline internal communications and efficiently manage emails, documents, projects, and customer relationships. With functionality that includes email, document, and calendar management, Group-Office can be used by teams for collaboration and task organization. The software is particularly beneficial for remote teams who require coordinated access to resources and data from diverse locations.

The vulnerability in Group-Office is a critical remote code execution (RCE) flaw. It stems from an OS command injection vulnerability, allowing attackers to execute arbitrary system commands. This threat is particularly severe as it grants attackers potential control over the web server hosting Group-Office. The vulnerability arises due to insufficient sanitization of user-supplied input when processing file uploads, where filenames are passed unsafely to system commands.

Specifically, the vulnerable endpoint is the file upload functionality in the 'files' module, where the 'name' parameter is not properly validated. An attacker can upload a file with a malicious filename containing shell metacharacters, such as semicolons or backticks, which are then executed by the underlying operating system. This allows the attacker to run arbitrary commands with the privileges of the web server process.

If exploited, an attacker can achieve full remote code execution on the server, leading to data theft, system compromise, and lateral movement within the network. The CVSS score of 9.9 reflects the critical nature of this vulnerability, as it requires no authentication and can be exploited remotely. Organizations using Group-Office are at high risk of complete server takeover if this flaw is not patched immediately.