# CVE-2026-25512: Group-Office - RCE

> Live exploitation tracking for CVE-2026-25512 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-25512

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.4
- **Public exploit available:** Yes
- **Affected products:** Intermesh Group-Office
- **Weaknesses:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
- **Tags:** enterprise_software

## Description

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, there is a remote code execution (RCE) vulnerability in Group-Office. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmp_file into an exec() call. By injecting shell metacharacters into tmp_file, an authenticated attacker can execute arbitrary system commands on the server. This issue has been patched in versions 6.8.150, 25.0.82, and 26.0.5.

## CrowdSec analysis

[CVE-2026-25512](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-25512) is a critical remote code execution vulnerability in Group-Office, where an authenticated attacker can exploit improper input handling in the email/message/tnefAttachmentFromTempFile endpoint to execute arbitrary system commands on the server. By injecting malicious shell metacharacters into the tmp_file parameter, attackers could gain full control over the affected system, potentially leading to data theft, service disruption, or further compromise of the network environment. This vulnerability is addressed in versions 6.8.150, 25.0.82, and 26.0.5.

CrowdSec has been tracking this vulnerability and its exploits since 15th of April 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-25512 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/index.php?r=email/message/tnefAttachmentFromTempFile` endpoint by injecting shell metacharacters into the `tmp_file` parameter, enabling remote code execution on vulnerable Group-Office installations. This attack requires authentication and targets the improper handling of user input in the `tmp_file` parameter.

## Timeline

- 2026-02-04: CVE Published. CVE-2026-25512 is published to NVD.
- 2026-04-15: Rule Released. CrowdSec releases a rule to detect CVE-2026-25512 exploitation attempts against the CrowdSec Network.

## References

- http://github.com/Intermesh/groupoffice/commit/6c612deca97a6cd2a1bd4feea0ce7e8e9d907792
- https://github.com/Intermesh/groupoffice/security/advisories/GHSA-579w-jvg7-frr4
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25512.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-25512) follows observed exploitation activity for CVE-2026-25512. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.