Threats affecting pkg:github/Group-Office

CVE-2026-125390 is an arbitrary local file read vulnerability in Intermesh Group-Office before versions 6.8.181, 25.0.116, and 26.0.58. It exists in the FolderController::actionProcessUploadQueue function, allowing authenticated users to supply absolute paths in the blobs parameter to read server files. This can lead to exposure of other users' stored files and sensitive configuration files such as config.php containing database credentials.

Intermesh Group-Office versions before 6.8.181, 25.0.116, and 26.0.58 contain a stored cross-site scripting (XSS) vulnerability in the email viewer. The flaw arises from improper input neutralization due to a flawed regex in StringHelper::filterXSS, allowing remote attackers to send emails with malicious tags such as svg/onload. When the recipient opens the email, the embedded script executes in their session via MessagePanel.js rendering the content raw. This vulnerability has a medium severity rating and is fixed in versions 6.8.181, 25.0.116, and 26.0.58.

Intermesh Group-Office versions before 6.8.181, 25.0.116, and 26.0.58 have a missing authorization vulnerability. Authenticated users can download form reports via the api/download.php endpoint without proper permission checks. This allows unauthorized export of form submissions as XLSX files, potentially exposing sensitive data.