CVE-2018-25438
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file' parameter, which is appended to the cache path and passed to readfile(), to read files such as /etc/passwd.
Risk Assessment
An unauthenticated attacker can read arbitrary files from the server, potentially leading to disclosure of sensitive data. Exploitation evidence has been observed in the wild.
Recommendation
Update Group-Office to version 3.5.5 or later. In the meantime, restrict access to /compress.php and monitor for suspicious requests.
Other vulnerabilities in Group-Office
See all- CVE-2026-34838Critical
Group-Office prior to versions 6.8.156, 25.0.90, and 26.0.12 has a vulnerability in the AbstractSettingsCollection model leading to insecure deserialization, allowing arbitrary file write and remote code execution.
- CVE-2026-45551Medium
In Group-Office prior to versions 26.0.25, 25.0.100, and 6.8.165, authenticated users can persist arbitrary legacy settings for any user_id. A separate issue in the email module injects the email_font_size setting directly into JavaScript without escaping. A low-privileged user can overwrite an administrator's email_font_size setting with a JavaScript payload and trigger stored XSS in the administrator's browser.
- CVE-2023-25292Medium
A reflected Cross Site Scripting (XSS) vulnerability was found in Intermesh BV Group-Office version 6.6.145. Attackers can exploit the GO_LANGUAGE cookie to escalate privileges and obtain sensitive information.
Original NVD description (English source)
Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file' parameter, which is appended to the cache path and passed to readfile(), to read files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-21.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS