Intermesh Group-Office Path Traversal Flaw Allows Unauthenticated File Read

Intermesh Group-Office versions before 3.5.5 are affected by a high-severity path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files. The flaw resides in the compress.php script and was actively exploited in the wild, as confirmed by monitoring data.

What happened

The vulnerability, tracked as CVE-2018-25438, exists in Intermesh Group-Office versions earlier than 3.5.5. It stems from improper handling of user input in the compress.php component. Remote attackers can manipulate the 'file' parameter in GET requests to traverse directories. This allows them to read sensitive system files, such as /etc/passwd, without needing valid credentials.

The Shadowserver Foundation first observed evidence of this exploitation on October 21, 2023. The organization detected malicious traffic targeting the vulnerable compress.php script. Attackers appended directory traversal sequences like '../' to the file parameter. This input was improperly appended to the cache path and passed directly to the readfile() function.

Why it matters

This flaw carries a CVSS score of 8.7, which classifies it as high severity. The lack of authentication requirements makes it particularly dangerous for internet-facing systems. Attackers can steal sensitive configuration files or credentials without prior access. This mirrors other recent path traversal issues, such as the TinyMCE Thumbnail Gallery bug affecting WordPress sites, which also allowed file theft before version 1.1.0.

As Patch Gazette reported on October 22, 2026, similar unauthenticated path traversal flaws in Kavita allowed attackers to steal files in versions prior to 0.5.4.1. The pattern shows that directory traversal remains a persistent risk in web applications. Intermesh Group-Office users must treat this as an urgent remediation priority.

What to watch

• Monitor web server logs for requests to compress.php containing directory traversal sequences.
• Check for unauthorized access to sensitive files like /etc/passwd or configuration databases.
• Verify that all Group-Office installations are updated to version 3.5.5 or later.
• Look for unusual outbound traffic that may indicate data exfiltration after file access.

Who needs to act first

Teams should prioritize updating internet-facing Group-Office instances immediately. These systems are directly exposed to unauthenticated attacks and face the highest risk of compromise. Internal systems should follow shortly after, especially if they are accessible from untrusted networks. Before applying updates, create backups to ensure rollback capability if issues arise. Test the update in a non-production environment

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe

• Virtual patching blocks traffic signatures, not the vulnerable code itself.
• Internal attackers bypass network-edge protections entirely.
• Logic flaws like broken access control often evade signature-based detection.

Virtual patching buys time, it does not fix code. Apply the real patch as soon as possible to remove the underlying risk.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.