CVE-2026-34838: Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.156, 25.0.90, and 26.0.12, a vulnerability in the AbstractSettingsCollection model leads to insecure deserialization when these settings are loaded. By injecting a serialized FileCookieJar object into a setting string, an authenticated attacker can achieve Arbitrary File Write, leading directly to Remote Code Execution (RCE) on the server. This issue has been patched in versions 6.8.156, 25.0.90, and 26.0.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Group-Office (AbstractSettingsCollection)to a version that resolves this vulnerability.Fixed in 6.8.156 - Upgrade
Upgrade
Group-Office (AbstractSettingsCollection)to a version that resolves this vulnerability.Fixed in 25.0.90 - Upgrade
Upgrade
Group-Office (AbstractSettingsCollection)to a version that resolves this vulnerability.Fixed in 26.0.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34838?
CVE-2026-34838 has a critical severity rating due to its potential for authenticated remote code execution.
How do I fix CVE-2026-34838?
To mitigate CVE-2026-34838, upgrade your Group-Office installation to versions 6.8.156, 25.0.90, or 26.0.12 or later.
What systems are affected by CVE-2026-34838?
CVE-2026-34838 affects Group-Office versions prior to 6.8.156, 25.0.90, and 26.0.12.
What type of vulnerability is CVE-2026-34838?
CVE-2026-34838 is an authenticated remote code execution vulnerability caused by PHP insecure deserialization in AbstractSettingsCollection.
Who is affected by CVE-2026-34838?
Organizations using vulnerable versions of Group-Office for customer relationship management and groupware are at risk due to CVE-2026-34838.