CVE-2026-125390: Group-Office before 6.8.181, 25.0.116, and 26.0.58 Local File Read via processUploadQueue
Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by supplying absolute paths in the blobs parameter. Attackers can have files hard-linked or copied into their own folder and downloaded, exposing other users' stored files and config.php database credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Group-Officeto a version that resolves this vulnerability.Fixed in 6.8.181 - Upgrade
Upgrade
Group-Officeto a version that resolves this vulnerability.Fixed in 25.0.116 - Upgrade
Upgrade
Group-Officeto a version that resolves this vulnerability.Fixed in 26.0.58
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated to Group-Office and have sufficient access to invoke the upload queue processing functionality. No user interaction is required.
What data could be exposed?
Attackers can read server-local files by providing absolute paths in the blobs parameter, then hard-linking or copying those files into a folder they control for download. This can expose other users' stored files and the config.php file containing database credentials.
Which releases are affected and which releases contain the fix?
Affected releases are versions before 6.8.181, 25.0.116, and 26.0.58. Upgrading to at least the applicable listed version addresses the issue.