Is CVE-2018-25438 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-25438 being exploited in the wild.

How severe is CVE-2018-25438?

High severity, with a CVSS score of 7.5, published 22 October 2026.

Which products and versions are affected?

Intermesh Group-Office 3.3.0 before 3.5.5.

Is there a fix for CVE-2018-25438?

Yes: fixed in 3.5.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-25438 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2018-25438?

Check whether you run Intermesh Group-Office at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-25438: Intermesh Group-Office path traversal in compress.php

CVE-2018-25438 · Severity: high · CVSS 7.5 · Published 2026-10-22

Intermesh Group-Office is a web-based collaboration platform used for messaging, calendaring, and file management. An unauthenticated attacker can read arbitrary files from the server by crafting specially formed requests that bypass access controls, potentially exposing sensitive configuration files, credentials, and user data.

Technologies: Intermesh Group-Office. Vendors: Intermesh.

Quick answers

Is CVE-2018-25438 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-25438 being exploited in the wild.
How severe is CVE-2018-25438?: High severity, with a CVSS score of 7.5, published 22 October 2026.
Which products and versions are affected?: Intermesh Group-Office 3.3.0 before 3.5.5.
Is there a fix for CVE-2018-25438?: Yes: fixed in 3.5.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-25438 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2018-25438?: Check whether you run Intermesh Group-Office at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.5.5

Technical details

An unauthenticated path traversal vulnerability exists in compress.php where the 'file' parameter is insufficiently validated before being passed to readfile(). By injecting directory traversal sequences (../) into the 'file' GET parameter, attackers can read files outside the intended cache directory, such as /etc/passwd on Unix systems. No authentication is required to exploit this vulnerability.

Affected products

Intermesh Group-Office 3.3.0 before 3.5.5

Timeline

2018-02-23: disclosed
2023-10-21: exploited: Exploitation evidence observed by Shadowserver Foundation
2026-10-22: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.