CVE-2026-25134
Published: 02 February 2026
Summary
CVE-2026-25134 is a critical-severity Argument Injection (CWE-88) vulnerability in Group-Office Group Office. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-25134 is a high-severity vulnerability (CVSS 8.8) in Group-Office, an enterprise customer relationship management and groupware tool. In versions prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceController exposes a zipLanguage action that accepts a lang parameter and passes it directly to the system zip command via exec(), without proper sanitization. This constitutes CWE-88 (improper neutralization of command separators in a command) and enables remote code execution when combined with uploading a crafted ZIP file.
The vulnerability can be exploited by an authenticated attacker with low privileges over the network, requiring low attack complexity and no user interaction. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, allowing arbitrary remote code execution on the affected server.
The issue is addressed in Group-Office releases 6.8.150, 25.0.82, and 26.0.5. Additional details are available in the GitHub security advisory at https://github.com/Intermesh/groupoffice/security/advisories/GHSA-v39j-549w-8849 and the patching commit at https://github.com/Intermesh/groupoffice/commit/d28490a6a29936db7888aa841ab8ade88800540b.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5404
Vulnerability details
Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceController exposes an action zipLanguage which takes a lang parameter and passes it directly to a system zip command via exec(). This can…
more
be combined with uploading a crafted zip file to achieve remote code execution. This vulnerability is fixed in 6.8.150, 25.0.82, and 26.0.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows remote code execution via command injection in a public-facing web application (Group-Office) by passing unsanitized input to the system zip command (Unix Shell).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Remediating the identified flaw by patching to Group-Office versions 6.8.150, 25.0.82, or 26.0.5 directly eliminates the command injection vulnerability in the MaintenanceController's exec() usage.
Requires validation and error handling for the user-supplied 'lang' parameter before passing it to the system zip command via exec(), preventing command separator injection.
Vulnerability scanning identifies unpatched Group-Office instances affected by this RCE flaw, enabling timely remediation to prevent exploitation.