{"id":"CVE-2026-63011","aliases":[],"cve":{"records":[{"id":"CVE-2026-63011","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-14T23:10:57.033Z","published":"2026-11-10T16:35:37.835Z","modified":"2026-11-10T21:05:39.787Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-11-10T16:35:37.835Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-10T21:05:39.787Z"}],"references":[{"url":"https://github.com/Intermesh/groupoffice/security/advisories/GHSA-4m9w-3p93-6cwx","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/Intermesh/groupoffice/releases/tag/v25.0.102","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/Intermesh/groupoffice/releases/tag/v26.0.27","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/Intermesh/groupoffice/releases/tag/v6.8.167","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-94","description":"CWE-94: Improper Control of Generation of Code ('Code Injection')","source":"GitHub_M"},{"id":"CWE-95","description":"CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","source":"GitHub_M"},{"id":"CWE-184","description":"CWE-184: Incomplete List of Disallowed Inputs","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-10T21:04:58.470980Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"GroupOffice Vulnerable to RCE in TemplateParser eval() via Contact/labels","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Contact/labels JMAP endpoint in GroupOffice accepts a fully attacker-controlled template string (tpl parameter) that is passed without restriction to TemplateParser::parse(). When the template contains an [assign] block whose expression includes a {{...}} variable reference, the engine calls eval() on the expanded expression after running it through a validateExpression() guard. The guard double-quotes unrecognized tokens, but PHP 7+ allows a string enclosed in parentheses to be invoked as a function (\"system\")(\"id\") is valid PHP and calls system(\"id\"). A single authenticated HTTP request is sufficient to execute arbitrary OS commands as the web server user (www-data). This issue has been patched in versions 6.8.167, 25.0.102, and 26.0.27.","score":9.4,"severity":"critical","published":"2026-11-10T16:35:37.835Z","modified":"2026-11-10T21:05:39.787Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Intermesh","name":"groupoffice","platforms":[],"versions":[{"version":"< 6.8.167","status":"affected"},{"version":"< 25.0.102","status":"affected"},{"version":"< 26.0.27","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-63011"}],"remediation":[],"references":["https://github.com/Intermesh/groupoffice/security/advisories/GHSA-4m9w-3p93-6cwx","https://github.com/Intermesh/groupoffice/releases/tag/v25.0.102","https://github.com/Intermesh/groupoffice/releases/tag/v26.0.27","https://github.com/Intermesh/groupoffice/releases/tag/v6.8.167"],"sources":[{"name":"CVE","id":"CVE-2026-63011","modified":"2026-11-10T21:05:39.787Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-63011"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":9.4}],"sourceAffected":[],"observedAt":"2026-11-11T02:57:05.114Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-10T16:50:45.037Z","attemptedAt":"2026-11-10T16:50:45.037Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T16:50:39.895Z","attemptedAt":"2026-11-10T16:50:39.895Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-10T16:50:40.656Z","attemptedAt":"2026-11-10T16:50:40.656Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T16:50:42.429Z","attemptedAt":"2026-11-10T16:50:42.429Z"}],"evidence":[],"aiSummary":{"text":"GroupOffice versions prior to 6.8.167, 25.0.102, and 26.0.27 are vulnerable to code injection via the Contact/labels JMAP endpoint, allowing an authenticated attacker to execute arbitrary OS commands. The vulnerability occurs due to the TemplateParser eval() function. A single authenticated HTTP request is sufficient to exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T16:46:13.692Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-63011"}]}}