---
id: "CVE-2018-25438"
kind: "vulnerability"
aliases: ["CVE-2018-25438"]
title: "Group-Office: unauthenticated file read via compress.php path traversal"
severity: "high"
cvss: 8.7
epss: 0.00536
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["group-office", "package", "php", "self-hosted"]
not_affected_if: ["managed-hosting", "version-3.5.5-or-later"]
published_at: "2026-10-22T11:17:03+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25438", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-25438", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Group-Office: unauthenticated file read via compress.php path traversal

Group-Office versions 3.3.0 before 3.5.5 let any remote visitor read arbitrary files on the server through the file parameter of compress.php. An attacker can request files such as /etc/passwd without logging in.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed Group-Office version (3.3.0 to before 3.5.5 is affected) and whether /compress.php responds to a GET request with '../' in the file parameter.

## Fix

Upgrade Group-Office to 3.5.5 or later. unknown for any interim workaround.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-25438
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2018-25438

## From the sources

Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file' parameter, which is appended to the cache path and passed to readfile(), to read files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-21.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_