CVE-2026-25134

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceController exposes an action zipLanguage which takes a lang parameter and passes it directly to a system zip command via exec(). This can be combined with uploading a crafted zip file to achieve remote code execution. This vulnerability is fixed in 6.8.150, 25.0.82, and 26.0.5.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-88

Affected software

No affected versions have been published.

Timeline

Published: Feb 2, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-251354.5OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 have an inf CVE-2026-251366.1Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizabl CVE-2026-251379.1The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exp CVE-2026-251385.3Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizabl CVE-2026-251399.1RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other em CVE-2026-25146.1In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring p CVE-2026-251407.5apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who co CVE-2026-251419.8Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and p CVE-2026-2514210.0SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ which can be used to obt CVE-2026-251437.8melange allows users to build apk packages using declarative pipelines. From version 0.10.0 to before 0.40.3, an attacker who can influence CVE-2026-251445.3Talishar is a fan-made Flesh and Blood project. A Stored XSS exists in the chat in-game system. The playerID parameter in SubmitChat.php and CVE-2026-251455.5melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence