CVE-2026-25134

HighPublic PoC

Published: 02 February 2026

Published

02 February 2026

Modified

18 February 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0017 38.0th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-25134 is a high-severity Argument Injection (CWE-88) vulnerability in Group-Office Group Office. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Remediating the identified flaw by patching to Group-Office versions 6.8.150, 25.0.82, or 26.0.5 directly eliminates the command injection vulnerability in the MaintenanceController's exec() usage.

SI-10 Information Input Validation good match

prevent

Requires validation and error handling for the user-supplied 'lang' parameter before passing it to the system zip command via exec(), preventing command separator injection.

RA-5 Vulnerability Monitoring and Scanning good match

preventdetect

Vulnerability scanning identifies unpatched Group-Office instances affected by this RCE flaw, enabling timely remediation to prevent exploitation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

Why these techniques?

The vulnerability allows remote code execution via command injection in a public-facing web application (Group-Office) by passing unsanitized input to the system zip command (Unix Shell).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceController exposes an action zipLanguage which takes a lang parameter and passes it directly to a system zip command via exec(). This can…

be combined with uploading a crafted zip file to achieve remote code execution. This vulnerability is fixed in 6.8.150, 25.0.82, and 26.0.5.

Deeper analysisAI

CVE-2026-25134 is a high-severity vulnerability (CVSS 8.8) in Group-Office, an enterprise customer relationship management and groupware tool. In versions prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceController exposes a zipLanguage action that accepts a lang parameter and passes it directly to the system zip command via exec(), without proper sanitization. This constitutes CWE-88 (improper neutralization of command separators in a command) and enables remote code execution when combined with uploading a crafted ZIP file.

The vulnerability can be exploited by an authenticated attacker with low privileges over the network, requiring low attack complexity and no user interaction. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, allowing arbitrary remote code execution on the affected server.

The issue is addressed in Group-Office releases 6.8.150, 25.0.82, and 26.0.5. Additional details are available in the GitHub security advisory at https://github.com/Intermesh/groupoffice/security/advisories/GHSA-v39j-549w-8849 and the patching commit at https://github.com/Intermesh/groupoffice/commit/d28490a6a29936db7888aa841ab8ade88800540b.