CVE-2026-125390

EUVD-2026-120553
Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by supplying absolute paths in the blobs parameter. Attackers can have files hard-linked or copied into their own folder and downloaded, exposing other users' stored files and config.php database credentials.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 29.32%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
intermeshgroup-office
𝑥
< 6.8.181
CNA
intermeshgroup-office
25.0.0 ≤
𝑥
< 25.0.116
CNA
intermeshgroup-office
26.0.0 ≤
𝑥
< 26.0.58
CNA
Common Weakness Enumeration
References
https://github.com/Intermesh/groupoffice/blob/v26.0.57/www/modules/files/controller/FolderController.php#L1550
https://github.com/Intermesh/groupoffice/commit/3c8e2104e65242b611f7d5a9a19452e369b6f28d
https://github.com/Intermesh/groupoffice/commit/46b9d67e26765d9fad558c143e5d1bed45b636ac
https://github.com/Intermesh/groupoffice/commit/5fd450887af707596fb6bdffa1fa1011064460a5
https://github.com/Intermesh/groupoffice/security/advisories/GHSA-pf66-g36v-7698
https://www.vulncheck.com/advisories/group-office-before-6.8.181-25.0.116-and-26.0.58-local-file-read-via-processuploadqueue