Description
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in the GroupOffice installer, endpoint install/license.php. The POST field license is rendered without escaping inside a <textarea>, allowing a </textarea><script>...</script> breakout.. This issue has been patched in versions 6.8.155, 25.0.88, and 26.0.10.
Published: 2026-03-06
Score: 2.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Reflected Cross‑Site Scripting in GroupOffice installer
Action: Apply Patch
AI Analysis

Impact

A reflected XSS flaw exists in the installer license page of GroupOffice, where a POST variable is inserted into a textarea without escaping, permitting a CDATA break and arbitrary script execution. The vulnerability can be used to run malicious scripts in the browser of anyone who views the license page, potentially stealing session cookies or executing other client‑side attacks.

Affected Systems

Intermesh GroupOffice versions earlier than 6.8.155, 25.0.88, and 26.0.10 are affected. The flaw resides in the install/license.php endpoint used during installation.

Risk and Exploitability

The CVSS score of 2.1 indicates low severity, and the EPSS score of less than 1 % reflects a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to reach the installer page, which normally exists only on a freshly provisioned server; therefore the attack surface is limited. Despite the low risk, the flaw permits user‑containing script injection and should be remediated promptly.

Generated by OpenCVE AI on April 16, 2026 at 11:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade GroupOffice to version 6.8.155, 25.0.88, or 26.0.10 or newer.
  • Remove or restrict access to the installer pages in a production environment.
  • Add server‑side input validation to the license parameter to escape or strip HTML before rendering.

Generated by OpenCVE AI on April 16, 2026 at 11:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 11 Mar 2026 13:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Mon, 09 Mar 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 09 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Intermesh
Intermesh group-office
Vendors & Products Intermesh
Intermesh group-office

Fri, 06 Mar 2026 21:30:00 +0000

Type Values Removed Values Added
Description Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in the GroupOffice installer, endpoint install/license.php. The POST field license is rendered without escaping inside a <textarea>, allowing a </textarea><script>...</script> breakout.. This issue has been patched in versions 6.8.155, 25.0.88, and 26.0.10.
Title Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Intermesh Group-office
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-03-09T20:54:28.748Z

Reserved: 2026-03-04T17:23:59.798Z

Link: CVE-2026-30237

cve-icon Vulnrichment

Updated: 2026-03-09T20:47:30.409Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-06T22:16:01.283

Modified: 2026-03-11T13:33:49.167

Link: CVE-2026-30237

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T11:15:27Z

Weaknesses