CVE-2026-34838

Katalog CVE

CVSS 9.9 · Critical EPSS 0,99%

Kerentanan Deserialization of Untrusted Data pada intermesh group-office. Skor CVSS 3.1 9.9 (Critical) menurut github.com.

Deskripsi (NVD)

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.156, 25.0.90, and 26.0.12, a vulnerability in the AbstractSettingsCollection model leads to insecure deserialization when these settings are loaded. By injecting a serialized FileCookieJar object into a setting string, an authenticated attacker can achieve Arbitrary File Write, leading directly to Remote Code Execution (RCE) on the server. This issue has been patched in versions 6.8.156, 25.0.90, and 26.0.12.

Rincian

Terbit di NVD

2 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.9 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,99% peluang dieksploitasi; lebih tinggi dari 61,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Intermesh/groupoffice/security/advisories/GHSA-h22j-frrf-5vxq advisory vendor
• https://github.com/Intermesh/groupoffice/releases/tag/v25.0.90 release notes
• https://github.com/Intermesh/groupoffice/releases/tag/v26.0.12 release notes
• https://github.com/Intermesh/groupoffice/releases/tag/v6.8.156 release notes