PT-2026-29881 · Unknown · Group-Office

Aarjubh · Published 2026-04-02 · Updated 2026-04-06 · CVE-2026-34838

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Group-Office versions prior to 6.8.156, prior to 25.0.90, and prior to 26.0.12

Description Group-Office is an enterprise customer relationship management and groupware tool. A flaw in the AbstractSettingsCollection model allows for insecure deserialization when loading settings. An authenticated attacker can inject a serialized FileCookieJar object into a setting string, leading to Arbitrary File Write and ultimately Remote Code Execution (RCE) on the server. The vulnerability is triggered through the deserialization of a FileCookieJar object. The AbstractSettingsCollection model is the component affected.

Recommendations Update to version 6.8.156 or later. Update to version 25.0.90 or later. Update to version 26.0.12 or later.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-34838

Affected Products

Group-Office

References · 10

• https://github.com/Intermesh/groupoffice/security/advisories/GHSA-h22j-frrf-5vxq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34838 · Security Note
• https://github.com/Intermesh/groupoffice/releases/tag/v25.0.90 · Note
• https://github.com/Intermesh/groupoffice/releases/tag/v26.0.12 · Note
• https://github.com/Intermesh/groupoffice/releases/tag/v6.8.156 · Note
• https://twitter.com/CveFindCom/status/2039828559460454569 · Twitter Post
• https://twitter.com/CVEnew/status/2040128767712985443 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2041155213361566062 · Twitter Post
• https://twitter.com/0dayPublishing/status/2039786059194622212 · Twitter Post
• https://twitter.com/TheHackerWire/status/2039900939944182043 · Twitter Post