CVE-2026-27947

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27947", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-25T03:11:36.690Z", "datePublished": "2026-02-27T19:52:41.592Z", "dateUpdated": "2026-03-03T20:24:32.730Z"}, "containers": {"cna": {"title": "Group-Office Vulnerable to Remote Code Execution (RCE)", "problemTypes": [{"descriptions": [{"cweId": "CWE-88", "lang": "en", "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-434", "lang": "en", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0"}}], "references": [{"name": "https://github.com/Intermesh/groupoffice/security/advisories/GHSA-2rwh-9qp7-f92x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Intermesh/groupoffice/security/advisories/GHSA-2rwh-9qp7-f92x"}], "affected": [{"vendor": "Intermesh", "product": "groupoffice", "versions": [{"version": ">= 26.0.0, < 26.0.9", "status": "affected"}, {"version": ">= 25.0.0, < 25.0.87", "status": "affected"}, {"version": "< 6.8.154", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-27T19:52:41.592Z"}, "descriptions": [{"lang": "en", "value": "Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.9, 25.0.87, and 6.8.154 have an authenticated Remote Code Execution vulnerability in the TNEF attachment processing flow. The vulnerable path extracts attacker-controlled files from `winmail.dat` and then invokes `zip` with a shell wildcard (`*`). Because extracted filenames are attacker-controlled, they can be interpreted as `zip` options and lead to arbitrary command execution. Versions 26.0.9, 25.0.87, and 6.8.154 fix the issue."}], "source": {"advisory": "GHSA-2rwh-9qp7-f92x", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-03T20:24:24.671913Z", "id": "CVE-2026-27947", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T20:24:32.730Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27947", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-03T20:24:24.671913Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T20:24:27.720Z"}}], "cna": {"title": "Group-Office Vulnerable to Remote Code Execution (RCE)", "source": {"advisory": "GHSA-2rwh-9qp7-f92x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Intermesh", "product": "groupoffice", "versions": [{"status": "affected", "version": ">= 26.0.0, < 26.0.9"}, {"status": "affected", "version": ">= 25.0.0, < 25.0.87"}, {"status": "affected", "version": "< 6.8.154"}]}], "references": [{"url": "https://github.com/Intermesh/groupoffice/security/advisories/GHSA-2rwh-9qp7-f92x", "name": "https://github.com/Intermesh/groupoffice/security/advisories/GHSA-2rwh-9qp7-f92x", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.9, 25.0.87, and 6.8.154 have an authenticated Remote Code Execution vulnerability in the TNEF attachment processing flow. The vulnerable path extracts attacker-controlled files from `winmail.dat` and then invokes `zip` with a shell wildcard (`*`). Because extracted filenames are attacker-controlled, they can be interpreted as `zip` options and lead to arbitrary command execution. Versions 26.0.9, 25.0.87, and 6.8.154 fix the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-88", "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-27T19:52:41.592Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27947", "state": "PUBLISHED", "dateUpdated": "2026-03-03T20:24:32.730Z", "dateReserved": "2026-02-25T03:11:36.690Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-27T19:52:41.592Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "groupoffice", "vendor": "Intermesh", "versions": [{"status": "affected", "version": ">= 26.0.0, < 26.0.9"}, {"status": "affected", "version": ">= 25.0.0, < 25.0.87"}, {"status": "affected", "version": "< 6.8.154"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*", "matchCriteriaId": "B7884A40-14BE-4D43-BAF3-12175EEB863D", "versionEndExcluding": "6.8.154", "vulnerable": true}, {"criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*", "matchCriteriaId": "A0895EF8-BAFE-41A6-90CE-EFAFBCE273D5", "versionEndExcluding": "25.0.87", "versionStartIncluding": "25.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*", "matchCriteriaId": "8DFBE230-B5B4-4163-B441-E9D0446D05DA", "versionEndExcluding": "26.0.9", "versionStartIncluding": "26.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.9, 25.0.87, and 6.8.154 have an authenticated Remote Code Execution vulnerability in the TNEF attachment processing flow. The vulnerable path extracts attacker-controlled files from `winmail.dat` and then invokes `zip` with a shell wildcard (`*`). Because extracted filenames are attacker-controlled, they can be interpreted as `zip` options and lead to arbitrary command execution. Versions 26.0.9, 25.0.87, and 6.8.154 fix the issue."}, {"lang": "es", "value": "Group-Office es una herramienta empresarial de gesti\u00f3n de relaciones con clientes y groupware. Las versiones anteriores a 26.0.9, 25.0.87 y 6.8.154 tienen una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo autenticada en el flujo de procesamiento de adjuntos TNEF. La ruta vulnerable extrae archivos controlados por el atacante de 'winmail.dat' y luego invoca 'zip' con un comod\u00edn de shell ('*'). Debido a que los nombres de archivo extra\u00eddos son controlados por el atacante, pueden ser interpretados como opciones de 'zip' y conducir a la ejecuci\u00f3n de comandos arbitrarios. Las versiones 26.0.9, 25.0.87 y 6.8.154 solucionan el problema."}], "id": "CVE-2026-27947", "lastModified": "2026-06-17T10:27:57.467", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27947", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-03T20:24:24.671913Z", "version": "2.0.3"}}]}, "published": "2026-02-27T20:21:40.513", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/Intermesh/groupoffice/security/advisories/GHSA-2rwh-9qp7-f92x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-88"}, {"lang": "en", "value": "CWE-434"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[26.0.0,26.0.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[25.0.0,25.0.87)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.8.154)"}}], "enrichment": {"confidence": 98.0, "confidence_source": "matching", "scores": [{"score": 98.0, "source": "matching"}]}, "original": {"product": "groupoffice", "source": "cna", "vendor": "Intermesh"}, "product": "group-office", "vendor": "intermesh"}], "analysis": {"en": {"generated_at": "2026-04-16T15:19:02.093011+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2011supplied upgrade to version 26.0.9, 25.0.87, or 6.8.154 to remove the vulnerable code", "After upgrading, verify that the TNEF processing path no longer invokes zip with unvalidated filenames; if still present, re\u2011configure the system to sanitize or reject winmail.dat attachments so that filenames cannot be interpreted as shell options", "Continuously monitor upload logs for suspicious winmail.dat activity and any failed or abnormal zip executions, and enforce strict file\u2011name validation to prevent future exploitation attempts"], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Intermesh Group-Office installations running versions earlier than 26.0.9, 25.0.87, or 6.8.154. Upgrading to any of those release numbers or later removes the flaw.", "description_and_impact": "Group-Office, an enterprise customer relationship management and groupware system, contains an authenticated Remote Code Execution vulnerability in the TNEF attachment processing flow. The flaw allows an authenticated attacker to upload a winmail.dat file that, when processed, extracts attacker\u2011controlled filenames and then invokes the zip utility with a shell wildcard. Because the filenames are not validated, they are interpreted as zip options, enabling the attacker to supply arbitrary shell commands and execute them with the privileges of the web server process. The weakness is a file\u2013upload restriction issue (CWE\u2011434) combined with shell expansion abuse (CWE\u201188).", "risk_and_exploitability": "The CVSS score of 9.4 classifies this as critical, and the documented exploitation requires authenticated access, meaning the attacker must first obtain valid credentials or leverage an existing user session. The EPSS score of less than 1% indicates that exploitation is rare at present, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Nonetheless, the high severity rating and the ability to execute arbitrary commands represent a significant threat to confidentiality, integrity, and availability for any affected system. Remediation through an upgrade is the only confirmed mitigation."}}}}, "created": "2026-03-02T12:05:03.620403+00:00", "updated": "2026-04-16T15:30:06.213153+00:00", "vendors": ["intermesh", "intermesh$PRODUCT$group-office"]}