---
id: "CVE-2026-63011"
page: "https://infrastack.ai/live/CVE-2026-63011"
kind: "vulnerability"
aliases: ["CVE-2026-63011"]
title: "Group-Office: authenticated template injection lets a request run OS commands"
severity: "critical"
cvss: 9.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["group-office", "other", "php", "self-hosted"]
not_affected_if: ["patched-version"]
published_at: "2026-11-10T17:17:45+00:00"
first_seen_at: "2026-11-10T17:22:44+00:00"
updated_at: "2026-11-10T17:23:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63011", "first_seen_at": "2026-11-10T17:22:44+00:00"}]
exploit_sources: []
---

# Group-Office: authenticated template injection lets a request run OS commands

Link for people: https://infrastack.ai/live/CVE-2026-63011 (this .md is for agents)

Group-Office, a customer relationship and groupware tool, passes an attacker-supplied template to an eval call in the Contact/labels JMAP endpoint. A logged-in user can send one HTTP request that runs arbitrary operating system commands as the web server user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Group-Office version against the fixed releases listed in the sources.

## Fix

- Upgrade to `6.8.167`, `25.0.102`, or `26.0.27` depending on the release branch in use.

## Timeline

- 2026-11-10T17:22:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63011

## Documents

- [advisory] Vendor advisory: github.com https://github.com/Intermesh/groupoffice/security/advisories/GHSA-4m9w-3p93-6cwx
- [fix] Release notes: github.com https://github.com/Intermesh/groupoffice/releases/tag/v25.0.102
- [fix] Release notes: github.com https://github.com/Intermesh/groupoffice/releases/tag/v26.0.27
- [fix] Release notes: github.com https://github.com/Intermesh/groupoffice/releases/tag/v6.8.167

## From the sources

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Contact/labels JMAP endpoint in GroupOffice accepts a fully attacker-controlled template string (tpl parameter) that is passed without restriction to TemplateParser::parse(). When the template contains an [assign] block whose expression includes a {{...}} variable reference, the engine calls eval() on the expanded expression after running it through a validateExpression() guard. The guard double-quotes unrecognized tokens, but PHP 7+ allows a string enclosed in parentheses to be invoked as a function ("system")("id") is valid PHP and calls system("id"). A single authenticated HTTP request is sufficient to execute arbitrary OS commands as the web server user (www-data). This issue has been patched in versions 6.8.167, 25.0.102, and 26.0.27.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_