CVE-2018-25438 Intermesh Group-Office < 3.5.5 Path Traversal via compress.php
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2018-25438?
CVE-2018-25438 is a high-severity vulnerability in Intermesh Group-Office, published on 22 Oct 2026.
Official description
Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file' parameter, which is appended to the cache path and passed to readfile(), to read files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-21.
Weakness: CWE-22
Which versions are affected by CVE-2018-25438?
How do I fix CVE-2018-25438?
No fix has been published for CVE-2018-25438 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-25438 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-25438 exists.
Sources
Also known as GHSA-vvmf-fxj8-j775.