GROUP-OFFICE · CVE-2026-125390 · Other
NO FIX YET · SEE WHAT TO DO
Group-Office, a groupware suite, lets any logged-in user read files from the server by passing absolute paths to an upload queue endpoint. An attacker can read other users' stored files and config.php, which holds database credentials.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any self-hosted Group-Office instance before the fixed versions where users can log in is exposed, since the flaw needs only an authenticated account. Instances on a version at or above the fixed release for their line are not affected. The sources do not say whether non-default configuration is required.
Not affected if patched-version
Who cares group-office, php, self-hosted
6.8.181, 25.0.116, or 26.0.58, matching your release line.Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by supplying absolute paths in the blobs parameter. Attackers can have files hard-linked or copied into their own folder and downloaded, exposing other users' stored files and config.php database credentials.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.