CVE-2026-25134: Group-Office RCE Vulnerability

CVE-2026-25134 Overview

Group-Office, an enterprise customer relationship management and groupware tool, contains a critical command injection vulnerability in the MaintenanceController. Prior to versions 6.8.150, 25.0.82, and 26.0.5, the zipLanguage action accepts a lang parameter that is passed directly to a system zip command via exec() without proper sanitization. An attacker with low privileges can exploit this flaw by combining it with the ability to upload a crafted zip file, ultimately achieving remote code execution on the underlying server.

Critical Impact

This vulnerability allows authenticated attackers to execute arbitrary system commands on the server, potentially leading to complete system compromise, data exfiltration, and lateral movement within the network.

Affected Products

• Group-Office versions prior to 6.8.150
• Group-Office versions prior to 25.0.82
• Group-Office versions prior to 26.0.5

Discovery Timeline

• 2026-02-02 - CVE-2026-25134 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-25134

Vulnerability Analysis

The vulnerability resides in the MaintenanceController component of Group-Office, specifically within the zipLanguage action. This action is designed to handle language file archiving functionality but fails to properly sanitize user-supplied input before passing it to a shell command.

The lang parameter provided by the user is concatenated directly into a command string that is executed via PHP's exec() function. This classic command injection pattern (CWE-88: Improper Neutralization of Argument Delimiters in a Command) allows attackers to break out of the intended command context and inject arbitrary shell commands.

The exploitation chain involves two steps: first, uploading a specially crafted zip file to the server, and second, triggering the zipLanguage action with a malicious lang parameter that references the uploaded file or injects additional commands. This combination enables full remote code execution with the privileges of the web server process.

Root Cause

The root cause of this vulnerability is improper input validation and the use of unsanitized user input in shell command construction. The zipLanguage action directly incorporates the lang parameter into an exec() call without escaping shell metacharacters or validating the input against an allowlist of expected values. This violates the principle of treating all user input as untrusted and demonstrates the dangers of constructing shell commands with string concatenation.

Attack Vector

The attack vector is network-based, requiring only low-privilege authentication to the Group-Office application. An attacker can exploit this vulnerability by:

1. Authenticating to the Group-Office application with any valid user account
2. Uploading a malicious zip file containing a payload (such as a PHP webshell)
3. Sending a crafted request to the MaintenanceController's zipLanguage action with shell metacharacters in the lang parameter
4. The injected commands execute on the server with the privileges of the web application

The vulnerability mechanism involves argument injection into the exec() function call. When the lang parameter contains shell metacharacters such as semicolons, backticks, or command substitution syntax, the attacker can terminate the intended zip command and append arbitrary commands. For detailed technical implementation, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-25134

Indicators of Compromise

• Unusual HTTP requests to the MaintenanceController endpoint containing shell metacharacters in the lang parameter
• Web server access logs showing requests with URL-encoded shell commands (;, |, `, $())
• Unexpected child processes spawned by the PHP or web server process
• New or modified files in web-accessible directories, particularly PHP files that may serve as webshells

Detection Strategies

• Monitor web application firewall (WAF) logs for requests targeting maintenance endpoints with suspicious parameter values
• Implement file integrity monitoring on Group-Office installation directories to detect unauthorized modifications
• Configure SIEM rules to alert on command injection patterns in HTTP request parameters
• Review PHP error logs for unexpected exec() failures or shell command errors

Monitoring Recommendations

• Enable verbose logging for the Group-Office application and review logs for anomalous maintenance operations
• Deploy endpoint detection and response (EDR) solutions to monitor for suspicious process chains originating from web server processes
• Implement network traffic analysis to identify potential data exfiltration following exploitation
• Regularly audit user accounts for unauthorized access or privilege escalation

How to Mitigate CVE-2026-25134

Immediate Actions Required

• Upgrade Group-Office to version 6.8.150, 25.0.82, or 26.0.5 or later immediately
• Review web server access logs for signs of exploitation attempts
• Audit all user accounts and revoke any suspicious or unnecessary access
• Perform a file integrity check on the Group-Office installation to identify any unauthorized modifications

Patch Information

The vulnerability has been fixed in Group-Office versions 6.8.150, 25.0.82, and 26.0.5. The patch addresses the command injection by properly sanitizing the lang parameter before use in shell commands. Organizations should apply the update as soon as possible.

For technical details on the fix, refer to the security patch commit.

Workarounds

• Restrict access to the MaintenanceController endpoints at the web server level using IP allowlisting or authentication requirements
• Implement a web application firewall (WAF) rule to block requests containing shell metacharacters in the lang parameter
• Disable or remove the zipLanguage functionality if not required for business operations
• Run the web server with minimal privileges to limit the impact of successful exploitation

# Example: Restrict access to maintenance endpoints in Apache
<Location "/api/maintenance">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>