CVE-2026-25512

CVE-2026-25512 is a remote code execution (RCE) vulnerability affecting Group-Office versions prior to 6.8.150, 25.0.82, and 26.0.5. An authenticated attacker can exploit a flaw in the email/message/tnefAttachmentFromTempFile endpoint, which improperly concatenates user-controlled input into an exec() call. This allows for the injection of shell metacharacters and execution of arbitrary system commands on the server. The vulnerability carries a CVSS score of 8.8 (High), indicating a network-based attack with low complexity, requiring low privileges, and leading to high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.