Group-Office before 6.8.181, 25.0.116, and 26.0.58 Local File Read via processUploadQueue
Affects Group-Office before 6.8.181, 25.0.116, and 26.0.58 for any authenticated user with CREATE permission on their own home folder. CVSS scores it 7.1 (high). Fixed in 6.8.181, 25.0.116, and 26.0.58.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 6.8.181, 25.0.116, 26.0.58
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Authenticated user with CREATE permission on their own home folder Group-Office versions before the patched releases (affected: 26.0.57 and earlier in the 26.0 line, and earlier 25.0 and 6.8 releases)
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 15/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by supplying absolute paths in the blobs parameter. Attackers can have files hard-linked or copied into their own folder and downloaded, exposing other users' stored files and config.php database credentials.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.1/10CVSS 7.1
- No patch0/5No signal
What would change the score
- Would score about 65 if added to CISA KEV
- Would score about 60 if CISA's SSVC rates exploitation active
- Would score about 22 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Authenticated user with CREATE permission on their own home folder Group-Office versions before the patched releases (affected: 26.0.57 and earlier in the 26.0 line, and earlier 25.0 and 6.8 releases)Upgrade to a fixed version: 6.8.181, 25.0.116, 26.0.58.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Intermesh Group-Office
fixed in 6.8.181; From 25.0.0 · fixed in 25.0.116; From 26.0.0 · fixed in 26.0.58
Evidence 6
- Advisory
- Patch
- Patch
- Patch
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-125390
Is CVE-2026-125390 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A logged-in user with create permission on their own home folder can use the upload queue processing to read files the PHP process can access. That includes the Group-Office config file with database credentials, other users' stored files that bypass folder access controls, and system files.Source: github.com, vulncheck.com
Which versions are affected by CVE-2026-125390?
Group-Office: before 6.8.181; from 25.0.0 before 25.0.116; from 26.0.0 before 26.0.58.Source: cve.now feed data
Am I affected, and how do I check?
Versions before 6.8.181, 25.0.116, and 26.0.58 are affected, including 26.0.57 and earlier in the 26.0 line and earlier 25.0 and 6.8 releases. The affected setup requires an authenticated user with CREATE permission on their own home folder; check your installed version and the permissions on home folders in the admin settings.Source: github.com, vulncheck.com
How do I fix CVE-2026-125390?
Upgrade to 6.8.181, 25.0.116, or 26.0.58, depending on which release line you run.Source: github.com, vulncheck.com