Intermesh Group-Office: Path Traversal in compress.php
Summary
Group-Office versions 3.3.0 up to, but not including, 3.5.5 contain an unauthenticated path traversal flaw in compress.php. A remote attacker can send crafted GET requests with '../' sequences in the file parameter to read arbitrary files that the web server can access, such as /etc/passwd. No login is required, so internet-facing instances are at particular risk. The CNA rates the issue as high severity, and NVD analysis is still pending.
Affected
- Intermesh Group-Office 3.3.0 to before 3.5.5
Fixed in
- Group-Office 3.5.5
- Confirm with the vendor whether newer branches (6.x, 25.x) are covered and whether the 3.x line is still supported.
Workaround
Unknown. No vendor-confirmed interim workaround found.
- Restrict external access to the application, or block access to compress.php at the reverse proxy or WAF (own recommendation, not from a source).
Exploitation
- The Shadowserver Foundation reportedly observed exploitation from 2023-10-21 (per CVE text).
- Sources conflict: no CISA KEV listing was found, and one aggregator states no known exploitation.
- A public Nuclei detection template exists, and a CXSecurity entry is tagged as an exploit.
Our recommendation
- Inventory all Group-Office instances and their exact versions.
- Upgrade instances from 3.3.0 to 3.5.4 to 3.5.5 or later, after confirming the supported version line with the vendor.
- Restrict external access where possible.
- Review web logs for requests to compress.php containing '../' sequences.
- Check the vendor advisory and CISA KEV status before final reporting.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CXSecurity: Groupoffice.com Directory Traversal Vulnerability cxsecurity.com
- ProjectDiscovery Nuclei template: groupoffice-lfi github.com
- Group-Office (vendor homepage) www.group-office.com
- VulnCheck advisory: Intermesh Group-Office path traversal via compress.php www.vulncheck.com
- VulDB entry 425254 vuldb.com
- HOL Guard: CVE-2018-25438 hol.org
- Strix: CVE-2018-25438 www.strix.ai
- Exploit-Intel: CVE-2018-25438 exploit-intel.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:52.
Original description (NVD)
Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file' parameter, which is appended to the cache path and passed to readfile(), to read files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-21.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.