Group-Office - RCE (CVE-2026-25512)
Description
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, there is a remote code execution (RCE) vulnerability in Group-Office. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmp_file into an exec() call. By injecting shell metacharacters into tmp_file, an authenticated attacker can execute arbitrary system commands on the server. This issue has been patched in versions 6.8.150, 25.0.82, and 26.0.5.
psychologyCrowdSec Analysis
CVE-2026-25512 is a critical remote code execution vulnerability in Group-Office, where an authenticated attacker can exploit improper input handling in the email/message/tnefAttachmentFromTempFile endpoint to execute arbitrary system commands on the server. By injecting malicious shell metacharacters into the tmp_file parameter, attackers could gain full control over the affected system, potentially leading to data theft, service disruption, or further compromise of the network environment. This vulnerability is addressed in versions 6.8.150, 25.0.82, and 26.0.5.
CrowdSec has been tracking this vulnerability and its exploits since 15th of April 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-25512 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the /index.php?r=email/message/tnefAttachmentFromTempFile endpoint by injecting shell metacharacters into the tmp_file parameter, enabling remote code execution on vulnerable Group-Office installations. This attack requires authentication and targets the improper handling of user input in the tmp_file parameter.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-02-04 |
| Rule Released | 2026-04-15 |