The vulnerability resides in the FolderController::actionProcessUploadQueue method of Group‑Office, where authenticated users can supply absolute file paths in the blobs parameter. This allows the application to read and serve any file accessible to the web‑server process, including other users' uploaded files and the config.php file that contains database credentials. The attacker can create a hard‑link or copy the target file into a folder they control and then trigger a download, exposing sensitive data. The primary impact is a confidentiality breach with the potential to compromise database credentials and other private documents.

Intermesh Group‑Office versions prior to 6.8.181, 25.0.116, and 26.0.58 are affected. The vulnerability is present in the core files referenced in the commits linked in the advisory. As a result, any installation of Group‑Office that has not been updated beyond these specific release numbers is at risk.

The CVSS score of 7.1 indicates a high severity. Because the flaw requires user authentication, an attacker must have valid credentials, which could be achieved via social engineering, credential reuse, or compromise of an existing account. Once authenticated, the attacker can construct the blobs parameter to point to arbitrary files and trigger a download. No exploit has been reported in the CISA KEV catalog, and EPSS data is unavailable, but the nature of the flaw and the ease of exploitation via standard upload interfaces suggest a non‑negligible chance of real‑world exploitation.