Description
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, there is a remote code execution (RCE) vulnerability in Group-Office. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmp_file into an exec() call. By injecting shell metacharacters into tmp_file, an authenticated attacker can execute arbitrary system commands on the server. This issue has been patched in versions 6.8.150, 25.0.82, and 26.0.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Intermesh | groupoffice | < 6.8.150, < 25.0.82, < 26.0.5 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
NumberOreo1/CVE-2026-25512 ★ 0 · Feb 4, 2026
RCE - Command Injection via TNEF Attachment Handler
-
mbanyamer/CVE-2026-25512-PoC-Group-Office-Authenticated-RCE ★ 0 · Feb 4, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Group-Office < 26.0.5 - Remote Code Execution http/cves/2026/CVE-2026-25512.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.