VYPR
← All advisories
High severity8.8NVD Advisory· Published Feb 4, 2026· Updated Jun 17, 2026

CVE-2026-25512

CVE-2026-25512

Description

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, there is a remote code execution (RCE) vulnerability in Group-Office. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmp_file into an exec() call. By injecting shell metacharacters into tmp_file, an authenticated attacker can execute arbitrary system commands on the server. This issue has been patched in versions 6.8.150, 25.0.82, and 26.0.5.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Intermesh/Group Office CRMllm-fuzzy
    Range: <6.8.150, <25.0.82, <26.0.5
  • Intermesh/Groupoffice2 versions
    cpe:2.3:a:group-office:group_office:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:group-office:group_office:*:*:*:*:*:*:*:*range: <6.8.150
    • (no CPE)range: < 6.8.150

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.