Local File Read Vulnerability in Group-Office by Intermesh
CVE-2026-125390

7.1HIGH

Key Information:

Vendor

Intermesh

Status
Group-office
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125390?

Group-Office versions prior to 6.8.181, 25.0.116, and 26.0.58 are susceptible to an arbitrary local file read vulnerability impacting the FolderController module. This flaw enables authenticated users to exploit the 'blobs' parameter to supply absolute file paths, allowing them to access sensitive server files. As a result, attackers could potentially hard-link or copy confidential files to their own directories, facilitating unauthorized downloads of critical content, including user data and database credentials, thus compromising overall system security.

Affected Version(s)

Group-Office 0 < 6.8.181

Group-Office 25.0.0 < 25.0.116

Group-Office 26.0.0 < 26.0.58

References

https://github.com/Intermesh/groupoffice/security/advisor...
vendor-advisory
https://github.com/Intermesh/groupoffice/blob/v26.0.57/ww...
technical-description
https://github.com/Intermesh/groupoffice/commit/46b9d67e2...
patch

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
.