Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
Group-Office: Malicious Files Can Be Executed Remotely
CVE-2026-27947
Summary
Group-Office versions before 26.0.9, 25.0.87, and 6.8.154 can allow hackers to run unauthorized code on your system if a user opens a specific type of email attachment. This can lead to data theft or system damage. Update to the latest version to fix this issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| intermesh | group-office | <= 6.8.154 | – |
| intermesh | group-office | > 25.0.1 , <= 25.0.87 | – |
| intermesh | group-office | > 26.0.1 , <= 26.0.9 | – |
Original title
Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.9, 25.0.87, and 6.8.154 have an authenticated Remote Code Execution vulnerability in the TN...
Original description
Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.9, 25.0.87, and 6.8.154 have an authenticated Remote Code Execution vulnerability in the TNEF attachment processing flow. The vulnerable path extracts attacker-controlled files from `winmail.dat` and then invokes `zip` with a shell wildcard (`*`). Because extracted filenames are attacker-controlled, they can be interpreted as `zip` options and lead to arbitrary command execution. Versions 26.0.9, 25.0.87, and 6.8.154 fix the issue.
nvd CVSS3.1
8.8
nvd CVSS4.0
9.4
Vulnerability type
CWE-88
CWE-434
Unrestricted File Upload
Published: 27 Feb 2026 · Updated: 13 Mar 2026 · First seen: 6 Mar 2026