CVE-2025-53505: Group-office Path Traversal Vulnerability

CVE-2025-53505 Overview

CVE-2025-53505 is a path traversal vulnerability [CWE-22] affecting Group-Office, a collaboration and CRM platform developed by Intermesh BV. The flaw exists in Group-Office versions prior to 6.8.119 and prior to 25.0.20. An authenticated remote attacker can manipulate file path input to access files outside the intended directory. Successful exploitation may expose information stored on the server hosting the application.

Critical Impact
Authenticated attackers can traverse directories on the underlying server to read files outside the application's intended scope, exposing configuration data and other sensitive server-side information.

Affected Products

Group-Office versions prior to 6.8.119
Group-Office versions prior to 25.0.20
Intermesh BV Group-Office collaboration platform

Discovery Timeline

2025-08-21 - CVE-2025-53505 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53505

Vulnerability Analysis

CVE-2025-53505 is classified as a path traversal weakness [CWE-22]. Group-Office fails to properly sanitize user-supplied path components used in file operations. An attacker with valid low-privilege credentials can submit crafted input containing directory traversal sequences such as ../ to reference files outside the web application's expected working directory.

Because the attack vector is network-based and requires only low privileges without user interaction, any authenticated user of the platform can attempt exploitation. The vulnerability results in disclosure of file contents accessible to the web server process.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory. Group-Office accepts path components from request parameters and constructs file system paths without canonicalizing input or validating that the resolved path remains within an authorized base directory.

Attack Vector

Exploitation occurs over the network against the Group-Office web interface. An authenticated attacker submits a request containing traversal sequences in a path parameter to reach files outside the intended directory. See the JVN Security Advisory JVN72111431 for additional context on the disclosure.

No verified public proof-of-concept code is available at the time of writing. The vulnerability mechanism follows the standard ../ traversal pattern applied against a vulnerable file-handling endpoint in the Group-Office application.

Detection Methods for CVE-2025-53505

Indicators of Compromise

HTTP request parameters containing ../, ..\, or URL-encoded variants such as %2e%2e%2f targeting Group-Office endpoints.
Web server access logs showing successful responses to requests that reference files outside the Group-Office web root, such as /etc/passwd or configuration files.
Authenticated Group-Office sessions issuing anomalous file-read requests inconsistent with normal user behavior.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect request parameters for directory traversal patterns and encoded traversal sequences.
Correlate authentication logs with file-access requests to identify low-privilege accounts probing file paths.
Review Group-Office application logs for repeated errors or file-not-found events that suggest path enumeration.

Monitoring Recommendations

Monitor for unexpected reads of sensitive system files by the web server process, such as /etc/passwd, /etc/shadow, or Group-Office config.php.
Alert on sudden spikes in HTTP 200 responses returning binary or text content from paths not associated with standard Group-Office assets.
Retain reverse proxy and application logs for forensic review of traversal attempts across authenticated sessions.

How to Mitigate CVE-2025-53505

Immediate Actions Required

Upgrade Group-Office to version 6.8.119 or later on the 6.x branch.
Upgrade Group-Office to version 25.0.20 or later on the 25.x branch.
Audit existing user accounts and rotate credentials for accounts that may have been used to probe the vulnerability.
Review web server and application logs for signs of prior exploitation before patching.

Patch Information

Intermesh BV has released fixed versions 6.8.119 and 25.0.20. Refer to the JVN Security Advisory JVN72111431 and the Group-Office Homepage for release information and download instructions.

Workarounds

Restrict network access to the Group-Office web interface using firewall rules or a reverse proxy allowlist until patches are applied.
Deploy WAF signatures blocking directory traversal sequences on all Group-Office request parameters.
Enforce least-privilege file system permissions on the account running the web server so it cannot read sensitive host files.
Require multi-factor authentication to raise the cost of acquiring the low-privilege credentials needed for exploitation.

bash

# Example nginx location block restricting traversal patterns
location /groupoffice/ {
    if ($args ~* "(\.\./|\.\.\\|%2e%2e)") {
        return 403;
    }
    proxy_pass http://groupoffice_backend;
}