CVE-2026-25134
Published: 02 February 2026
Description
Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceController exposes an action zipLanguage which takes a lang parameter and passes it directly to a system zip command via exec(). This can…
more
be combined with uploading a crafted zip file to achieve remote code execution. This vulnerability is fixed in 6.8.150, 25.0.82, and 26.0.5.
Mitigating Controls (NIST 800-53 r5)AI
Remediating the identified flaw by patching to Group-Office versions 6.8.150, 25.0.82, or 26.0.5 directly eliminates the command injection vulnerability in the MaintenanceController's exec() usage.
Requires validation and error handling for the user-supplied 'lang' parameter before passing it to the system zip command via exec(), preventing command separator injection.
Vulnerability scanning identifies unpatched Group-Office instances affected by this RCE flaw, enabling timely remediation to prevent exploitation.
Security SummaryAI
CVE-2026-25134 is a high-severity vulnerability (CVSS 8.8) in Group-Office, an enterprise customer relationship management and groupware tool. In versions prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceController exposes a zipLanguage action that accepts a lang parameter and passes it directly to the system zip command via exec(), without proper sanitization. This constitutes CWE-88 (improper neutralization of command separators in a command) and enables remote code execution when combined with uploading a crafted ZIP file.
The vulnerability can be exploited by an authenticated attacker with low privileges over the network, requiring low attack complexity and no user interaction. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, allowing arbitrary remote code execution on the affected server.
The issue is addressed in Group-Office releases 6.8.150, 25.0.82, and 26.0.5. Additional details are available in the GitHub security advisory at https://github.com/Intermesh/groupoffice/security/advisories/GHSA-v39j-549w-8849 and the patching commit at https://github.com/Intermesh/groupoffice/commit/d28490a6a29936db7888aa841ab8ade88800540b.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows remote code execution via command injection in a public-facing web application (Group-Office) by passing unsanitized input to the system zip command (Unix Shell).