CVE-2026-27947

The record

Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.9, 25.0.87, and 6.8.154 have an authenticated Remote Code Execution vulnerability in the TNEF attachment processing flow. The vulnerable path extracts attacker-controlled files from `winmail.dat` and then invokes `zip` with a shell wildcard (`*`). Because extracted filenames are attacker-controlled, they can be interpreted as `zip` options and lead to arbitrary command execution. Versions 26.0.9, 25.0.87, and 6.8.154 fix the issue.

Affected packages

Related vulnerabilities

• CVE-2026-112944 launch-editor allows users to open files with line numbers in editor from Node.js. CWE-88
• CVE-2026-112900 Pillow is a Python imaging library. CWE-88
• CVE-2026-105326 An argument injection flaw was found in CUPS. CWE-88
• CVE-2026-102827 simple-git, an interface for running git commands in any node.js application, enables… CWE-88
• CVE-2026-89066 Improper neutralization of special elements used in an OS command in the task synthesis… CWE-88
• CVE-2026-11765 Improper neutralization of argument delimiters in a command ('argument injection')… CWE-88
• CVE-2026-0304 A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables… CWE-88
• CVE-2026-8044 CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument… CWE-88