Search
Find a vulnerability
Search criteria
4 vulnerabilities found for group-office by intermesh
CVE-2026-125390 (GCVE-0-2026-125390)
Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
VLAI
EPSS
VEX
Title
Group-Office before 6.8.181, 25.0.116, and 26.0.58 Local File Read via processUploadQueue
Summary
Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by supplying absolute paths in the blobs parameter. Attackers can have files hard-linked or copied into their own folder and downloaded, exposing other users' stored files and config.php database credentials.
Severity
CWE
- CWE-36 - Absolute Path Traversal
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/Intermesh/groupoffice/security… | vendor-advisory |
| https://github.com/Intermesh/groupoffice/blob/v26… | technical-description |
| https://github.com/Intermesh/groupoffice/commit/4… | patch |
| https://github.com/Intermesh/groupoffice/commit/5… | patch |
| https://github.com/Intermesh/groupoffice/commit/3… | patch |
| https://www.vulncheck.com/advisories/group-office… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Intermesh | Group-Office |
Affected:
0 , < 6.8.181
(semver)
Affected: 25.0.0 , < 25.0.116 (semver) Affected: 26.0.0 , < 26.0.58 (semver) cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:* cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:* cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:* |
Date Public
2026-11-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Intermesh/groupoffice",
"product": "Group-Office",
"repo": "https://github.com/Intermesh/groupoffice",
"vendor": "Intermesh",
"versions": [
{
"lessThan": "6.8.181",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "25.0.116",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
},
{
"lessThan": "26.0.58",
"status": "affected",
"version": "26.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.181",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*",
"versionEndExcluding": "25.0.116",
"versionStartIncluding": "25.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.0.58",
"versionStartIncluding": "26.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-11-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by supplying absolute paths in the blobs parameter. Attackers can have files hard-linked or copied into their own folder and downloaded, exposing other users\u0027 stored files and config.php database credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-36",
"description": "Absolute Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T23:27:55.891Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-pf66-g36v-7698)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/Intermesh/groupoffice/security/advisories/GHSA-pf66-g36v-7698"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Intermesh/groupoffice/blob/v26.0.57/www/modules/files/controller/FolderController.php#L1550"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Intermesh/groupoffice/commit/46b9d67e26765d9fad558c143e5d1bed45b636ac"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Intermesh/groupoffice/commit/5fd450887af707596fb6bdffa1fa1011064460a5"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Intermesh/groupoffice/commit/3c8e2104e65242b611f7d5a9a19452e369b6f28d"
},
{
"name": "VulnCheck Advisory: Group-Office before 6.8.181, 25.0.116, and 26.0.58 Local File Read via processUploadQueue",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/group-office-before-6.8.181-25.0.116-and-26.0.58-local-file-read-via-processuploadqueue"
}
],
"title": "Group-Office before 6.8.181, 25.0.116, and 26.0.58 Local File Read via processUploadQueue",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125390",
"datePublished": "2026-11-09T23:27:55.891Z",
"dateReserved": "2026-11-09T22:03:11.388Z",
"dateUpdated": "2026-11-09T23:27:55.891Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125389 (GCVE-0-2026-125389)
Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
VLAI
EPSS
VEX
Title
Group-Office before 6.8.181, 25.0.116, and 26.0.58 Stored XSS via filterXSS Bypass
Summary
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in the email viewer due to a flawed regex in StringHelper::filterXSS. Remote attackers can send emails containing tags like svg/onload, which MessagePanel.js renders raw, executing script in the recipient's session when opened.
Severity
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/Intermesh/groupoffice/security… | vendor-advisory |
| https://github.com/Intermesh/groupoffice/blob/v26… | technical-description |
| https://github.com/Intermesh/groupoffice/commit/8… | patch |
| https://github.com/Intermesh/groupoffice/commit/b… | patch |
| https://github.com/Intermesh/groupoffice/commit/f… | patch |
| https://www.vulncheck.com/advisories/group-office… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Intermesh | Group-Office |
Affected:
0 , < 6.8.181
(semver)
Affected: 25.0.0 , < 25.0.116 (semver) Affected: 26.0.0 , < 26.0.58 (semver) cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:* cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:* cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:* |
Date Public
2026-11-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Intermesh/groupoffice",
"product": "Group-Office",
"repo": "https://github.com/Intermesh/groupoffice",
"vendor": "Intermesh",
"versions": [
{
"lessThan": "6.8.181",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "25.0.116",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
},
{
"lessThan": "26.0.58",
"status": "affected",
"version": "26.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.181",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*",
"versionEndExcluding": "25.0.116",
"versionStartIncluding": "25.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.0.58",
"versionStartIncluding": "26.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-11-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in the email viewer due to a flawed regex in StringHelper::filterXSS. Remote attackers can send emails containing tags like svg/onload, which MessagePanel.js renders raw, executing script in the recipient\u0027s session when opened."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T23:27:55.200Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-52gw-p4j3-v53c)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/Intermesh/groupoffice/security/advisories/GHSA-52gw-p4j3-v53c"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Intermesh/groupoffice/blob/v26.0.57/www/go/base/util/StringHelper.php#L799"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Intermesh/groupoffice/commit/8e9ff58807c5cfa71a34a48d80410479c1e7f9f5"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Intermesh/groupoffice/commit/bfc1fba43de53a6f662b1a12e31447a9c65d4d00"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Intermesh/groupoffice/commit/f32e9674b162342f0e4a43932f4adaf03e97c755"
},
{
"name": "VulnCheck Advisory: Group-Office before 6.8.181, 25.0.116, and 26.0.58 Stored XSS via filterXSS Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/group-office-before-6.8.181-25.0.116-and-26.0.58-stored-xss-via-filterxss-bypass"
}
],
"title": "Group-Office before 6.8.181, 25.0.116, and 26.0.58 Stored XSS via filterXSS Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125389",
"datePublished": "2026-11-09T23:27:55.200Z",
"dateReserved": "2026-11-09T22:03:11.018Z",
"dateUpdated": "2026-11-09T23:27:55.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125388 (GCVE-0-2026-125388)
Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-10 16:32
VLAI
EPSS
VEX
Title
Group-Office before 6.8.181, 25.0.116, and 26.0.58 Missing Authorization in Forms Report Download
Summary
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every submission as an XLSX file, disclosing submissions they are not permitted to see.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 16:31 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Intermesh/groupoffice/security… | vendor-advisory |
| https://github.com/Intermesh/groupoffice/blob/v26… | technical-description |
| https://www.vulncheck.com/advisories/group-office… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Intermesh | Group-Office |
Affected:
0 , < 6.8.181
(semver)
Affected: 25.0.0 , < 25.0.116 (semver) Affected: 26.0.0 , < 26.0.58 (semver) cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:* cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:* cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:* |
Date Public
2026-11-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125388",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T16:31:45.365118Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T16:32:06.433Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Intermesh/groupoffice/security/advisories/GHSA-42qf-m3j9-837r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Intermesh/groupoffice",
"product": "Group-Office",
"repo": "https://github.com/Intermesh/groupoffice",
"vendor": "Intermesh",
"versions": [
{
"lessThan": "6.8.181",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "25.0.116",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
},
{
"lessThan": "26.0.58",
"status": "affected",
"version": "26.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.181",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*",
"versionEndExcluding": "25.0.116",
"versionStartIncluding": "25.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.0.58",
"versionStartIncluding": "26.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-11-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every submission as an XLSX file, disclosing submissions they are not permitted to see."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T23:27:54.517Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-42qf-m3j9-837r)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/Intermesh/groupoffice/security/advisories/GHSA-42qf-m3j9-837r"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Intermesh/groupoffice/blob/v26.0.57/www/api/download.php#L89-L129"
},
{
"name": "VulnCheck Advisory: Group-Office before 6.8.181, 25.0.116, and 26.0.58 Missing Authorization in Forms Report Download",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/group-office-before-6.8.181-25.0.116-and-26.0.58-missing-authorization-in-forms-report-download"
}
],
"title": "Group-Office before 6.8.181, 25.0.116, and 26.0.58 Missing Authorization in Forms Report Download",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125388",
"datePublished": "2026-11-09T23:27:54.517Z",
"dateReserved": "2026-11-09T22:03:10.643Z",
"dateUpdated": "2026-11-10T16:32:06.433Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2018-25438 (GCVE-0-2018-25438)
Vulnerability from cvelistv5 – Published: 2026-10-22 10:57 – Updated: 2026-10-28 18:00 X_Known Exploited Vulnerability Unsupported When Assigned
VLAI
EPSS
VEX
Title
Intermesh Group-Office < 3.5.5 Path Traversal via compress.php
Summary
Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file' parameter, which is appended to the cache path and passed to readfile(), to read files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-21.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 18:00 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://cxsecurity.com/issue/WLB-2018020249 | exploit |
| https://github.com/projectdiscovery/nuclei-templa… | technical-description |
| https://www.group-office.com/ | product |
| https://www.vulncheck.com/advisories/intermesh-gr… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Intermesh | Group-Office |
Affected:
3.3.0 , < 3.5.5
(custom)
cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:* |
Date Public
2018-02-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2018-25438",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T18:00:03.575911Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T18:00:29.939Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Group-Office",
"vendor": "Intermesh",
"versions": [
{
"lessThan": "3.5.5",
"status": "affected",
"version": "3.3.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.5.5",
"versionStartIncluding": "3.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "indoushka"
},
{
"lang": "en",
"type": "reporter",
"value": "The Shadowserver Foundation"
}
],
"datePublic": "2018-02-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the \u0027file\u0027 parameter. Attackers can send GET requests to /compress.php with \u0027../\u0027 sequences in the \u0027file\u0027 parameter, which is appended to the cache path and passed to readfile(), to read files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-21."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T10:57:25.404Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "CXSecurity WLB-2018020249",
"tags": [
"exploit"
],
"url": "https://cxsecurity.com/issue/WLB-2018020249"
},
{
"name": "Nuclei Template",
"tags": [
"technical-description"
],
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/groupoffice-lfi.yaml"
},
{
"name": "Product Homepage",
"tags": [
"product"
],
"url": "https://www.group-office.com/"
},
{
"name": "VulnCheck Advisory: Intermesh Group-Office \u003c 3.5.5 Path Traversal via compress.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/intermesh-group-office-3.5.5-path-traversal-via-compress-php"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_known-exploited-vulnerability",
"unsupported-when-assigned"
],
"title": "Intermesh Group-Office \u003c 3.5.5 Path Traversal via compress.php",
"x_generator": {
"engine": "vulncheck-kclub"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2018-25438",
"datePublished": "2026-10-22T10:57:25.404Z",
"dateReserved": "2026-10-14T20:25:26.525Z",
"dateUpdated": "2026-10-28T18:00:29.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}