CVE-2026-25512 PoC — Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler

Title:Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler (CVE-2026-25512)
Description:Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, there is a remote code execution (RCE) vulnerability in Group-Office. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmp_file into an exec() call. By injecting shell metacharacters into tmp_file, an authenticated attacker can execute arbitrary system commands on the server. This issue has been patched in versions 6.8.150, 25.0.82, and 26.0.5.

Group-Office before versions 6.8.150, 25.0.82, and 26.0.5 is vulnerable to remote code execution via OS command injection. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmp_file into an exec() call. By injecting shell metacharacters into tmp_file, an authenticated attacker can execute arbitrary system commands on the server.

 id: CVE-2026-25512

info:
  name: Group-Office < 26.0.5 - Remote Code Execution
  author: omarkurt
 

...