EUVD-2026-120553

Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by supplying absolute paths in the blobs parameter. Attackers can have files hard-linked or...

CVE-2026-125390 Group-Office before 6.8.181, 25.0.116, and 26.0.58 Local File Read via processUploadQueue

Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by supplying absolute paths in the blobs parameter. Attackers can have files hard-linked or...

CVE-2026-125390

Intermesh Group-Office versions prior to 6.8.181 , 25.0.116 , and 26.0.58 are vulnerable to an arbitrary local file read vulnerability in the FolderController::actionProcessUploadQueue component. The root cause is the lack of validation on the blobs parameter, which allows authenticated users to ...