# CVE-2026-34838: Intermesh Group-Office insecure deserialization in AbstractSettingsCollection

Source: https://junglewise.ai/threats/cve-2026-34838-intermesh-group-office-insecure-deserialization-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-02. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-34838 · Severity: critical · CVSS 9.9 · Published 2026-04-02

Group-Office, an enterprise customer relationship management (CRM) and groupware platform, contains a vulnerability that allows authenticated users to execute malicious code on the server. By manipulating system settings, a user with low-level access can force the application to write a malicious file to the server's filesystem. This can lead to a total takeover of the server, resulting in the theft of sensitive customer data, service disruption, and full control over the application environment.

Technologies: [Intermesh Group-Office](https://junglewise.ai/threats/technologies/group-office). Vendors: [Intermesh](https://junglewise.ai/threats/vendors/intermesh).

## Quick answers

**Is CVE-2026-34838 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34838 being exploited in the wild.

**How severe is CVE-2026-34838?** Critical severity, with a CVSS score of 9.9, published 2 April 2026.

**Which products and versions are affected?** Intermesh Group-Office < 6.8.156, 25.0.1 - 25.0.89, 26.0.1 - 26.0.11.

**Is there a fix for CVE-2026-34838?** A patch was published on 2026-03-06: Release of patched versions 6.8.156, 25.0.90, and 26.0.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34838 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34838?** Check whether you run Intermesh Group-Office at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An insecure deserialization vulnerability exists in the `_loadData()` method of the `AbstractSettingsCollection` model in Group-Office. The application identifies serialized data by a 'serialized:' prefix and passes the subsequent string to PHP's `unserialize()` function without class validation. An authenticated attacker can exploit this by using the `core/saveSetting` controller to inject a malicious payload into the `go_settings` database table. By utilizing a POP chain involving the bundled `GuzzleHttp\Cookie\FileCookieJar` class, an attacker can trigger an arbitrary file write during object destruction. This allows for the creation of a PHP web shell, leading to Remote Code Execution (RCE). The issue is patched in versions 6.8.156, 25.0.90, and 26.0.12.

## Affected products

- Intermesh Group-Office < 6.8.156, 25.0.1 - 25.0.89, 26.0.1 - 26.0.11

## Timeline

- 2026-03-06: patched: Release of patched versions 6.8.156, 25.0.90, and 26.0.12
- 2026-03-31: advisory: Vendor security advisory published via GitHub
- 2026-04-02: disclosed: CVE-2026-34838 published to NVD

## References

- [https://github.com/Intermesh/groupoffice/releases/tag/v25.0.90](https://github.com/Intermesh/groupoffice/releases/tag/v25.0.90)
- [https://github.com/Intermesh/groupoffice/releases/tag/v26.0.12](https://github.com/Intermesh/groupoffice/releases/tag/v26.0.12)
- [https://github.com/Intermesh/groupoffice/releases/tag/v6.8.156](https://github.com/Intermesh/groupoffice/releases/tag/v6.8.156)
- [https://github.com/Intermesh/groupoffice/security/advisories/GHSA-h22j-frrf-5vxq](https://github.com/Intermesh/groupoffice/security/advisories/GHSA-h22j-frrf-5vxq)

## Related threats

- [Group-Office server-side request forgery in Bookmark description](https://junglewise.ai/threats/cve-2026-63653-group-office-is-an-enterprise-customer-relationship-management)
- [Group-Office template injection in Contact/labels JMAP endpoint](https://junglewise.ai/threats/cve-2026-63011-group-office-is-an-enterprise-customer-relationship-management)
- [Group-Office stored XSS in reminders via HTML/JavaScript injection](https://junglewise.ai/threats/cve-2026-63010-group-office-is-an-enterprise-customer-relationship-management)
- [Group-Office arbitrary local file read in FolderController](https://junglewise.ai/threats/cve-2026-125390-group-office-before-6-8-181-25-0-116-and-26-0-58-contains-an)
- [Intermesh Group-Office stored XSS in email viewer](https://junglewise.ai/threats/cve-2026-125389-intermesh-group-office-before-6-8-181-25-0-116-and-26-0-58)