CVE-2026-23887

Group-Office has stored XSS vulnerability via unsanitized filenames

Published Jan 21, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Description

Group-Office is an enterprise customer relationship management and groupware tool. In versions 6.8.148 and below, and 25.0.1 through 25.0.79, the application stores unsanitized filenames in the database, which can lead to Stored Cross-Site Scripting (XSS). Users who interact with these specially crafted file names within the Group-Office application are affected. While the scope is limited to the file-viewing context, it could still be used to interfere with user sessions or perform unintended actions in the browser. This issue is fixed in versions 6.8.149 and 25.0.80.

Analysis

Technical impact

The vulnerability occurs when the application stores file names that have not been sanitized, allowing an attacker to embed malicious script code into the metadata stored for a file. When a user opens or views that file, the embedded script is executed in the user's browser, which can break session integrity or cause unintended browser actions. The vulnerability is a classic stored XSS flaw and is classified as input validation and cross‑site scripting (CWE‑20, CWE‑79).

Affected Systems

Intermesh Group‑Office 6.8.148 and earlier, as well as 25.0.1 through 25.0.79 are affected. The fix is available in 6.8.149 and 25.0.80.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate impact, while the EPSS score of <1% suggests exploitation is unlikely in the short term. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a malicious file name during an upload or file‑creation operation, after which the victim must interact with the file in the application. The risk is confined to the file‑viewing context but can still be used to interfere with user sessions or trigger unexpected client‑side behavior.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Intermesh

groupoffice

affected

Version	Status	Constraints
`< 6.8.149`	affected	—
`>= 25.0.1, < 25.0.80`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:group-office:group_office::::::::
	cpe:2.3:a:group-office:group_office::::::::

No data.

Vendor	Product	Versions
Intermesh	Group-office	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Group‑Office 6.8.149 or 25.0.80, which contain a fix that sanitizes file names
Configure file upload controls to reject filenames containing script tags or special characters before they are stored
Audit existing files for potentially malicious names and clean or delete any that appear suspicious

Generated by OpenCVE AI on April 18, 2026 at 04:02 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.274% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/Intermesh/groupoffice/commit/3fa40d7edd31fbe33babe07061d5a14ad19ea40f
https://github.com/Intermesh/groupoffice/commit/ac91b128157bc9c5ea015b6141ce71cd3bbc43f0
https://github.com/Intermesh/groupoffice/security/advisories/GHSA-3gj5-gvvr-g6hp

History

Feb 18, 2026 3:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Group-office Group-office group Office
CPEs		cpe:2.3:a:group-office:group_office::::::::
Vendors & Products		Group-office Group-office group Office
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}`

Jan 23, 2026 4:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Intermesh Intermesh group-office
Vendors & Products		Intermesh Intermesh group-office

Jan 22, 2026 11:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jan 22, 2026 12:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Group-Office is an enterprise customer relationship management and groupware tool. In versions 6.8.148 and below, and 25.0.1 through 25.0.79, the application stores unsanitized filenames in the database, which can lead to Stored Cross-Site Scripting (XSS). Users who interact with these specially crafted file names within the Group-Office application are affected. While the scope is limited to the file-viewing context, it could still be used to interfere with user sessions or perform unintended actions in the browser. This issue is fixed in versions 6.8.149 and 25.0.80.
Title		Group-Office has stored XSS vulnerability via unsanitized filenames
Weaknesses		CWE-20 CWE-79
References		https://github.com/Intermesh/groupoffice/commit/3fa40d7edd31fbe33babe07061d5a14ad19ea40f https://github.com/Intermesh/groupoffice/commit/ac91b128157bc9c5ea015b6141ce71cd3bbc43f0 https://github.com/Intermesh/groupoffice/security/advisories/GHSA-3gj5-gvvr-g6hp
Metrics		cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}`