GHSA-pf66-g36v-7698: Group-Office before 6.8.181, 25.0.116, and 26.0.58 Local File Read via processUploadQueue
Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by supplying absolute paths in the blobs parameter. Attackers can have files hard-linked or copied into their own folder and downloaded, exposing other users' stored files and config.php database credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Group-Officeto a version that resolves this vulnerability.Fixed in 6.8.181 - Upgrade
Upgrade
Group-Officeto a version that resolves this vulnerability.Fixed in 25.0.116 - Upgrade
Upgrade
Group-Officeto a version that resolves this vulnerability.Fixed in 26.0.58
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Group-Office user can exploit it remotely by sending absolute filesystem paths in the blobs parameter to FolderController::actionProcessUploadQueue. No user interaction is required.
What data could be exposed?
An attacker can cause readable server files to be hard-linked or copied into a folder they control and then download them. This can expose other users' stored files and the config.php file, including database credentials.
Which releases need to be updated?
Affected releases are versions before 6.8.181, 25.0.116, and 26.0.58. Upgrade to the applicable listed version or a later release.