{"id":"CVE-2018-25438","kind":"vulnerability","aliases":["CVE-2018-25438"],"related":[],"title":"Group-Office: unauthenticated file read via compress.php path traversal","description":"Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file' parameter, which is appended to the cache path and passed to readfile(), to read files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-21.","summary":"Group-Office versions 3.3.0 before 3.5.5 let any remote visitor read arbitrary files on the server through the file parameter of compress.php. An attacker can request files such as /etc/passwd without logging in.","severity":"high","cvss":8.7,"epss":0.00536,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["group-office","package","php","self-hosted"],"not_affected_if":["managed-hosting","version-3.5.5-or-later"],"how_to_check":"Check the installed Group-Office version (3.3.0 to before 3.5.5 is affected) and whether /compress.php responds to a GET request with '../' in the file parameter.","fix":"Upgrade Group-Office to 3.5.5 or later. unknown for any interim workaround.","status":"open","published_at":"2026-10-22T11:17:03+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:35:23+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:35:23Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Group-Office to 3.5.5 or later. unknown for any interim workaround.","reach":"internet","title":"Group-Office: unauthenticated file read via compress.php path traversal","impact":"high","summary":"Group-Office versions 3.3.0 before 3.5.5 let any remote visitor read arbitrary files on the server through the file parameter of compress.php. An attacker can request files such as /etc/passwd without logging in.","category":"package","who_cares":["group-office","self-hosted","php"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads arbitrary server files, including config and credentials.","analyst_note":"Confirm the exact fixed version and any vendor advisory for the workaround at https://nvd.nist.gov/vuln/detail/CVE-2018-25438.","how_to_check":"Check the installed Group-Office version (3.3.0 to before 3.5.5 is affected) and whether /compress.php responds to a GET request with '../' in the file parameter.","needs_analyst":true,"not_affected_if":["managed-hosting","version-3.5.5-or-later"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000513,"input_tokens":2997,"output_tokens":427,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-10':127C '-2018':12A,15A '-21':128C '-25438':13A,16A '/compress.php':92C '/etc/passwd':55B,115C '2023':126C '3.3.0':29B,62C '3.5.5':31B,64C 'allow':74C 'append':101C 'arbitrari':37B,79C 'attack':49B,76C,86C 'cach':104C 'compress.php':8A,47B,72C 'contain':65C 'cve':11A,14A 'evid':117C 'exploit':116C 'file':5A,38B,44B,52B,80C,84C,97C,112C 'first':119C 'foundat':124C 'get':89C 'group':2A,18B,26B,60C 'group-offic':1A,17B,25B,59C 'host':24B 'intermesh':58C 'let':32B 'log':57B 'manipul':82C 'observ':120C 'offic':3A,19B,27B,61C 'packag':20B 'paramet':45B,85C,98C 'pass':107C 'path':9A,68C,105C 'php':21B 'read':6A,36B,78C,111C 'readfil':109C 'remot':34B,75C 'request':51B,90C 'self':23B 'self-host':22B 'send':88C 'sequenc':94C 'server':41B 'shadowserv':123C 'travers':10A,69C 'unauthent':4A,67C 'version':28B 'via':7A 'visitor':35B 'vulner':70C 'without':56B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2018-25438","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-25438","severity":null,"published_at":"2026-10-22T11:17:03+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2018-25438","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-25438","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}