# CVE-2026-63011: Group-Office template injection in Contact/labels JMAP endpoint

Source: https://junglewise.ai/threats/cve-2026-63011-group-office-is-an-enterprise-customer-relationship-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-63011 · Severity: info · Published 2026-11-10

Group-Office is an enterprise CRM and groupware platform used for customer relationship management and collaboration. The Contact/labels JMAP endpoint accepts user-supplied template strings that are evaluated without proper sanitization, allowing authenticated attackers to execute arbitrary operating system commands as the web server user. An attacker with valid credentials can compromise the entire server and access all data stored on it.

Technologies: [Intermesh Group-Office](https://junglewise.ai/threats/technologies/group-office). Vendors: [Intermesh](https://junglewise.ai/threats/vendors/intermesh).

## Quick answers

**Is CVE-2026-63011 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63011 being exploited in the wild.

**How severe is CVE-2026-63011?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** Intermesh Group-Office before 6.8.167, 25.0.102, and 26.0.27.

**Is there a fix for CVE-2026-63011?** Yes: fixed in 6.8.167, 25.0.102, 26.0.27. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63011 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-63011?** Check whether you run Intermesh Group-Office at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.8.167, 25.0.102, 26.0.27

## Technical details

The Contact/labels JMAP endpoint passes an attacker-controlled template string (tpl parameter) directly to TemplateParser::parse() without restriction. A validateExpression() guard is present but can be bypassed: it double-quotes unrecognized tokens, but PHP 7+ allows parenthesized strings to be invoked as functions (e.g., ("system")("id")), causing eval() to execute arbitrary code. The vulnerability requires authentication but only a single HTTP request to achieve remote code execution as the www-data user.

## Affected products

- Intermesh Group-Office before 6.8.167, 25.0.102, and 26.0.27

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/Intermesh/groupoffice/releases/tag/v25.0.102](https://github.com/Intermesh/groupoffice/releases/tag/v25.0.102)
- [https://github.com/Intermesh/groupoffice/releases/tag/v26.0.27](https://github.com/Intermesh/groupoffice/releases/tag/v26.0.27)

## Related threats

- [Group-Office server-side request forgery in Bookmark description](https://junglewise.ai/threats/cve-2026-63653-group-office-is-an-enterprise-customer-relationship-management)
- [Group-Office stored XSS in reminders via HTML/JavaScript injection](https://junglewise.ai/threats/cve-2026-63010-group-office-is-an-enterprise-customer-relationship-management)
- [Group-Office arbitrary local file read in FolderController](https://junglewise.ai/threats/cve-2026-125390-group-office-before-6-8-181-25-0-116-and-26-0-58-contains-an)
- [Intermesh Group-Office stored XSS in email viewer](https://junglewise.ai/threats/cve-2026-125389-intermesh-group-office-before-6-8-181-25-0-116-and-26-0-58)
- [Intermesh Group-Office missing authorization in form report download](https://junglewise.ai/threats/cve-2026-125388-intermesh-group-office-before-6-8-181-25-0-116-and-26-0-58)