Eval Injection in Group Office - CVE-2026-63011
Published: November 9, 2026
Vulnerability identifier: #VU162760
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-63011
CWE-ID: CWE-95
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated remote attacker to execute arbitrary operating system commands as the web server user in GroupOffice.
The vulnerability exists due to insufficient validation of attacker-controlled templates in TemplateParser when the Contact/labels endpoint processes assignment expressions containing variable references. An authenticated remote attacker can submit a crafted template and an existing contact ID in a single request to execute commands without elevated privileges or victim interaction.
Affected software
Group Office
How to mitigate CVE-2026-63011
Install security update from vendor's website.
Group Office - addressed in versions 6.8.167, 25.0.102, 26.0.27