CVE-2025-63406: Command Injection
Published Nov 13, 2025
·Updated
An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi() and eval() in the FunctionField.php
Affected Software
3 affected components
Intermesh GroupOffice<25.0.47, <6.8.136
Group-Office Group Office<6.8.136
Group-Office Group Office>=25.0.1<25.0.47
Event History
Nov 13, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-63406?
CVE-2025-63406 is classified as a critical vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2025-63406?
To remediate CVE-2025-63406, upgrade Intermesh GroupOffice to versions 25.0.47 or 6.8.136 or later.
3
What are the affected versions in CVE-2025-63406?
The affected versions for CVE-2025-63406 are all versions prior to 25.0.47 and 6.8.136.
4
How can an attacker exploit CVE-2025-63406?
An attacker can exploit CVE-2025-63406 by using dbToApi() and eval() functions in FunctionField.php to execute arbitrary code.
5
Is CVE-2025-63406 a zero-day vulnerability?
CVE-2025-63406 was not publicly disclosed prior to the release of the fix, but it may be exploited if not patched promptly.