Path traversal in Group Office - CVE-2026-125390
Published: November 10, 2026
Vulnerability identifier: #VU164342
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-125390
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to read arbitrary files accessible to the PHP process, including database credentials and other users' stored files.
The vulnerability exists due to improper restriction of source paths in Group-Office's files/folder/processUploadQueue endpoint when processing strings in the blobs parameter without confining them to the temporary blob directory. A remote user can submit a JSON array containing absolute paths such as /etc/groupoffice/config.php and select a destination folder with CREATE permission to copy or hard-link sensitive files into their own folder for download, bypassing source-folder access controls.
Affected software
Group Office
How to mitigate CVE-2026-125390
Install security update from vendor's website.
Group Office - addressed in versions 6.8.181, 26.0.58