by Kastro
Paper/Archive/CVE-2026-27947

CVE-2026-27947

Intermesh groupoffice — Group-Office Vulnerable to Remote Code Execution (RCE)

EPSS 0.8%CVSS 9.4
critical.is priorityof 100
40
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 56.6.566 × 2011.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.9, 25.0.87, and 6.8.154 have an authenticated Remote Code Execution vulnerability in the TNEF attachment processing flow. The vulnerable path extracts attacker-controlled files from `winmail.dat` and then invokes `zip` with a shell wildcard (`*`). Because extracted filenames are attacker-controlled, they can be interpreted as `zip` options and lead to arbitrary command execution. Versions 26.0.9, 25.0.87, and 6.8.154 fix the issue.

Affected

ProductAffectedFixed inSource
groupoffice>= 26.0.0, < 26.0.9–CNA
groupoffice>= 25.0.0, < 25.0.87–CNA
groupoffice< 6.8.154–CNA

Scores by source

GitHub_M (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/Intermesh/groupoffice/security/advisories/GHSA-2rwh-9qp7-f92x