CVE-2026-125390 Group-Office before 6.8.181, 25.0.116, and 26.0.58 Local File Read via processUploadQueue
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-125390?
CVE-2026-125390 is a high-severity vulnerability in Intermesh Group-Office, published on 9 Nov 2026.
Official description
Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by supplying absolute paths in the blobs parameter. Attackers can have files hard-linked or copied into their own folder and downloaded, exposing other users' stored files and config.php database credentials.
Weakness: CWE-36
Which versions are affected by CVE-2026-125390?
How do I fix CVE-2026-125390?
No fix has been published for CVE-2026-125390 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-125390 being exploited?
There is no known exploitation of CVE-2026-125390 in the wild and no public exploit code.
Sources
Also known as GHSA-7hj3-vffx-jm3w, GHSA-pf66-g36v-7698.