The vulnerability is a lack of input validation in the compress.php script of Intermesh Group‑Office. Attackers can supply a malicious 'file' parameter that contains '../' sequences. The script appends this value to the cache path and passes it to readfile(), enabling the extraction of files such as /etc/passwd. The impact is a confidentiality breach with potential access to system files or other sensitive files on the server.

Intermesh Group‑Office versions 3.3.0 through 3.5.4 are affected. Any installation relying on these minors is vulnerable until the update to 3.5.5 or later is applied.

The CVSS score of 8.7 indicates a high severity with remote execution from a network context. No EPSS data is available, but the vulnerability was observed in the wild in 2023, suggesting it is exploitable. It is not listed in CISA’s KEV catalog. Because no authentication is required, the attack can be performed by any external actor who can query the web server. The likely attack path is an HTTP GET request to /compress.php with a crafted 'file' parameter. Successful exploitation leads to arbitrary file read and potentially further posture exploitation.