# CVE-2018-25438: Intermesh Group-Office path traversal in compress.php

Source: https://junglewise.ai/threats/cve-2018-25438-intermesh-group-office-3-3-0-before-3-5-5-contains-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2018-25438 · Severity: high · CVSS 7.5 · Published 2026-10-22

Intermesh Group-Office is a web-based collaboration platform used for messaging, calendaring, and file management. An unauthenticated attacker can read arbitrary files from the server by crafting specially formed requests that bypass access controls, potentially exposing sensitive configuration files, credentials, and user data.

Technologies: [Intermesh Group-Office](https://junglewise.ai/threats/technologies/group-office). Vendors: [Intermesh](https://junglewise.ai/threats/vendors/intermesh).

## Quick answers

**Is CVE-2018-25438 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-25438 being exploited in the wild.

**How severe is CVE-2018-25438?** High severity, with a CVSS score of 7.5, published 22 October 2026.

**Which products and versions are affected?** Intermesh Group-Office 3.3.0 before 3.5.5.

**Is there a fix for CVE-2018-25438?** Yes: fixed in 3.5.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2018-25438 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2018-25438?** Check whether you run Intermesh Group-Office at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.5.5

## Technical details

An unauthenticated path traversal vulnerability exists in compress.php where the 'file' parameter is insufficiently validated before being passed to readfile(). By injecting directory traversal sequences (../) into the 'file' GET parameter, attackers can read files outside the intended cache directory, such as /etc/passwd on Unix systems. No authentication is required to exploit this vulnerability.

## Affected products

- Intermesh Group-Office 3.3.0 before 3.5.5

## Timeline

- 2018-02-23: disclosed
- 2023-10-21: exploited: Exploitation evidence observed by Shadowserver Foundation
- 2026-10-22: advisory

## References

- [https://cxsecurity.com/issue/WLB-2018020249](https://cxsecurity.com/issue/WLB-2018020249)
- [https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/groupoffice-lfi.yaml](https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/groupoffice-lfi.yaml)

## Related threats

- [Group-Office server-side request forgery in Bookmark description](https://junglewise.ai/threats/cve-2026-63653-group-office-is-an-enterprise-customer-relationship-management)
- [Group-Office template injection in Contact/labels JMAP endpoint](https://junglewise.ai/threats/cve-2026-63011-group-office-is-an-enterprise-customer-relationship-management)
- [Group-Office stored XSS in reminders via HTML/JavaScript injection](https://junglewise.ai/threats/cve-2026-63010-group-office-is-an-enterprise-customer-relationship-management)
- [Group-Office arbitrary local file read in FolderController](https://junglewise.ai/threats/cve-2026-125390-group-office-before-6-8-181-25-0-116-and-26-0-58-contains-an)
- [Intermesh Group-Office stored XSS in email viewer](https://junglewise.ai/threats/cve-2026-125389-intermesh-group-office-before-6-8-181-25-0-116-and-26-0-58)