CVE-2026-34838
Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`
CVSS Score
10.0
EPSS Score
0.0%
EPSS Percentile
0th
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.156, 25.0.90, and 26.0.12, a vulnerability in the AbstractSettingsCollection model leads to insecure deserialization when these settings are loaded. By injecting a serialized FileCookieJar object into a setting string, an authenticated attacker can achieve Arbitrary File Write, leading directly to Remote Code Execution (RCE) on the server. This issue has been patched in versions 6.8.156, 25.0.90, and 26.0.12.
| CWE | CWE-502 |
| Vendor | intermesh |
| Product | groupoffice |
| Published | Apr 2, 2026 |
| Last Updated | Apr 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for intermesh groupoffice
Be the first to know when new critical vulnerabilities affecting intermesh groupoffice are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Intermesh / groupoffice
< 6.8.156 < 25.0.90 < 26.0.12
References
github.com: https://github.com/Intermesh/groupoffice/security/advisories/GHSA-h22j-frrf-5vxq github.com: https://github.com/Intermesh/groupoffice/releases/tag/v25.0.90 github.com: https://github.com/Intermesh/groupoffice/releases/tag/v26.0.12 github.com: https://github.com/Intermesh/groupoffice/releases/tag/v6.8.156