CVE-2026-125390
Received Received - Intake

Arbitrary Local File Read in Group-Office

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: VulnCheck

Description
Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by supplying absolute paths in the blobs parameter. Attackers can have files hard-linked or copied into their own folder and downloaded, exposing other users' stored files and config.php database credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125390
EUVD
EUVD-2026-120553

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Intermesh Group-Office From 0 (inc) to 6.8.181 (exc)
Intermesh Group-Office From 25.0.0 (inc) to 25.0.116 (exc)
Intermesh Group-Office From 26.0.0 (inc) to 26.0.58 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-36 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an arbitrary local file read issue in Group-Office versions before 6.8.181, 25.0.116, and 26.0.58. Authenticated users can exploit it by supplying absolute file paths in the blobs parameter of the FolderController::actionProcessUploadQueue function. The system fails to validate these paths properly, allowing attackers to read sensitive files like config.php containing database credentials or other users' stored files.

Detection Guidance

Check Group-Office versions for affected releases (before 6.8.181, 25.0.116, and 26.0.58). Inspect logs for requests to the files/folder/processUploadQueue endpoint with absolute paths in the blobs parameter. Use network monitoring tools to detect unusual file read attempts or unauthorized access patterns.

Impact Analysis

An attacker with valid credentials could read sensitive server files, including other users' data and database credentials. This could lead to data breaches, unauthorized access to confidential information, or further system compromise by leveraging exposed credentials.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized access to sensitive personal and health data. GDPR mandates protection of personal data, while HIPAA requires safeguarding protected health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Update Group-Office to patched versions (6.8.181 or later, 25.0.116 or later, 26.0.58 or later). Restrict access to the processUploadQueue endpoint to authorized users only. Review and remove unnecessary file permissions for the PHP process. Monitor for suspicious activity in file operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125390. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...