Vulnerability · Published Feb 2, 2026 · Assigned by GitHub_M

CVE-2026-25134Group-Office Argument Injection in MaintenanceController::actionZipLanguage

Critical 9.4

In plain English

A critical-severity argument injection in groupoffice from Intermesh. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)0.9%top 40.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceController exposes an action zipLanguage which takes a lang parameter and passes it directly to a system zip command via exec(). This can be combined with uploading a crafted zip file to achieve remote code execution. This vulnerability is fixed in 6.8.150, 25.0.82, and 26.0.5.

Affected products (as reported)

Vendor	Product	Versions
Intermesh	groupoffice	< 6.8.150>= 25.0.0, < 25.0.82>= 26.0.0, < 26.0.5

Weakness: CWE-88 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://github.com/Intermesh/groupoffice/security/advisories/GHSA-v39j-549w-8849 x_refsource_CONFIRM
https://github.com/Intermesh/groupoffice/commit/d28490a6a29936db7888aa841ab8ade88800540b x_refsource_MISC