CVE-2026-25512: Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, there is a remote code execution (RCE) vulnerability in Group-Office. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmpfile into an exec() call. By injecting shell metacharacters into tmpfile, an authenticated attacker can execute arbitrary system commands on the server. This issue has been patched in versions 6.8.150, 25.0.82, and 26.0.5.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25512?
CVE-2026-25512 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-25512?
To fix CVE-2026-25512, upgrade Group-Office to version 6.8.150 or later, 25.0.82 or later, or 26.0.5 or later.
Which versions of Group-Office are affected by CVE-2026-25512?
Versions of Group-Office prior to 6.8.150, 25.0.82, and 26.0.5 are affected by CVE-2026-25512.
What type of vulnerability is CVE-2026-25512?
CVE-2026-25512 is a remote code execution (RCE) vulnerability caused by command injection.
Can CVE-2026-25512 be exploited remotely?
Yes, CVE-2026-25512 can be exploited remotely by attackers using specially crafted TNEF attachments.