RCE in Intermesh Groupoffice

CVE-2026-25512

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, there is a remote code execution (RCE) vulnerability in Group-Office. The endpoint email/message/tnefAttachm…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.238 (96.1th percentile) — read the EPSS interpretation.

Affected products

Intermesh Groupoffice — versions < 6.8.150, < 25.0.82, < 26.0.5

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

https://github.com/Intermesh/groupoffice/security/advisories/GHSA-579w-jvg7-frr4 (x_refsource_CONFIRM)
http://github.com/Intermesh/groupoffice/commit/6c612deca97a6cd2a1bd4feea0ce7e8e9d907792 (x_refsource_MISC)