Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by supplying absolute paths in the blobs parameter. Attackers can have files hard-linked or copied into their own folder and downloaded, exposing other users' stored files and config.php database credentials.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Intermesh Group-Office unaffected
Version Status Constraints
0 affected < 6.8.181
25.0.0 affected < 25.0.116
26.0.0 affected < 26.0.58

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Intermesh Subscribe
Group-office Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/Intermesh/groupoffice/blob/v26.0.57/www/modules/files/controller/FolderController.php#L1550 cve-icon cve-icon
https://github.com/Intermesh/groupoffice/commit/3c8e2104e65242b611f7d5a9a19452e369b6f28d cve-icon cve-icon
https://github.com/Intermesh/groupoffice/commit/46b9d67e26765d9fad558c143e5d1bed45b636ac cve-icon cve-icon
https://github.com/Intermesh/groupoffice/commit/5fd450887af707596fb6bdffa1fa1011064460a5 cve-icon cve-icon
https://github.com/Intermesh/groupoffice/security/advisories/GHSA-pf66-g36v-7698 cve-icon cve-icon
https://www.vulncheck.com/advisories/group-office-before-6.8.181-25.0.116-and-26.0.58-local-file-read-via-processuploadqueue cve-icon cve-icon
History

Mon, 09 Nov 2026 23:45:00 +0000

Type Values Removed Values Added
Description Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by supplying absolute paths in the blobs parameter. Attackers can have files hard-linked or copied into their own folder and downloaded, exposing other users' stored files and config.php database credentials.
Title Group-Office before 6.8.181, 25.0.116, and 26.0.58 Local File Read via processUploadQueue
First Time appeared Intermesh
Intermesh group-office
Weaknesses CWE-36
CPEs cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*
Vendors & Products Intermesh
Intermesh group-office
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-09T23:27:55.891Z

Reserved: 2026-11-09T22:03:11.388Z

Link: CVE-2026-125390

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-10T00:17:12.653

Modified: 2026-11-10T00:17:12.653

Link: CVE-2026-125390

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses