Group-Office contains a command injection flaw in its TNEF attachment handler, where user-provided input is concatenated directly into an exec() call. An attacker who is authenticated to the application can inject shell metacharacters into the tmp_file parameter, allowing the execution of arbitrary system commands on the web server. This can compromise the entire server, lead to data exfiltration, and provide a foothold for further lateral movement.

The vulnerability affects Intermesh Group‑Office versions prior to 6.8.150, 25.0.82, and 26.0.5. Any installation running one of these releases is at risk, regardless of the operating system, provided the email/message/tnefAttachmentFromTempFile endpoint remains accessible.

With a CVSS base score of 9.4 the flaw is considered critical, and an EPSS score of 23% indicates a moderate likelihood of exploitation in the near term. Because the exploit requires authentication to Group‑Office, it is a medium to high risk for organizations that expose the application over the network. The flaw is not listed in the CISA KEV catalog, but given its severity and exploit probability, it should not be ignored.