CVE-2026-34838
CriticalCVSS 9.9Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
Group-Office prior to versions 6.8.156, 25.0.90, and 26.0.12 has a vulnerability in the AbstractSettingsCollection model leading to insecure deserialization, allowing arbitrary file write and remote code execution.
Risk Assessment
An authenticated attacker can gain full control of the Group-Office server.
Recommendation
Upgrade Group-Office to one of the patched versions: 6.8.156, 25.0.90, or 26.0.12.
Other vulnerabilities in Group-Office
See all- CVE-2026-45551Medium
In Group-Office prior to versions 26.0.25, 25.0.100, and 6.8.165, authenticated users can persist arbitrary legacy settings for any user_id. A separate issue in the email module injects the email_font_size setting directly into JavaScript without escaping. A low-privileged user can overwrite an administrator's email_font_size setting with a JavaScript payload and trigger stored XSS in the administrator's browser.
- CVE-2023-25292Medium
A reflected Cross Site Scripting (XSS) vulnerability was found in Intermesh BV Group-Office version 6.6.145. Attackers can exploit the GO_LANGUAGE cookie to escalate privileges and obtain sensitive information.
Original NVD description (English source)
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.156, 25.0.90, and 26.0.12, a vulnerability in the AbstractSettingsCollection model leads to insecure deserialization when these settings are loaded. By injecting a serialized FileCookieJar object into a setting string, an authenticated attacker can achieve Arbitrary File Write, leading directly to Remote Code Execution (RCE) on the server. This issue has been patched in versions 6.8.156, 25.0.90, and 26.0.12.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS