Arbitrary OS Command Execution in Group-Office CRM Tool
CVE-2026-63011
9.4CRITICAL
What is CVE-2026-63011?
An issue was identified in Group-Office, an enterprise CRM and groupware solution, where the JMAP endpoint for Contact/labels inadequately processes user-defined template strings. This flaw enables an attacker to execute arbitrary OS commands on the server through crafted template inputs. Specifically, an authenticated user can form requests that leverage the eval() function, executing commands as the web server user. The vulnerability has been addressed in versions 6.8.167, 25.0.102, and 26.0.27, underscoring the importance of updating to the latest releases to mitigate potential exploitation.
Affected Version(s)
groupoffice < 6.8.167 < 6.8.167
groupoffice < 25.0.102 < 25.0.102
groupoffice < 26.0.27 < 26.0.27