Group-Office, an enterprise customer relationship management and groupware system, contains an authenticated Remote Code Execution vulnerability in the TNEF attachment processing flow. The flaw allows an authenticated attacker to upload a winmail.dat file that, when processed, extracts attacker‑controlled filenames and then invokes the zip utility with a shell wildcard. Because the filenames are not validated, they are interpreted as zip options, enabling the attacker to supply arbitrary shell commands and execute them with the privileges of the web server process. The weakness is a file–upload restriction issue (CWE‑434) combined with shell expansion abuse (CWE‑88).

The vulnerability affects Intermesh Group-Office installations running versions earlier than 26.0.9, 25.0.87, or 6.8.154. Upgrading to any of those release numbers or later removes the flaw.

The CVSS score of 9.4 classifies this as critical, and the documented exploitation requires authenticated access, meaning the attacker must first obtain valid credentials or leverage an existing user session. The EPSS score of less than 1% indicates that exploitation is rare at present, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Nonetheless, the high severity rating and the ability to execute arbitrary commands represent a significant threat to confidentiality, integrity, and availability for any affected system. Remediation through an upgrade is the only confirmed mitigation.