Group‑Office exposes a reflected cross‑site scripting flaw in its external index interface. A parameter named f – which carries Base64‑encoded JSON – is decoded and injected directly into an inline JavaScript block without proper escaping. By crafting a payload that closes the existing script block, injects new script tags, and reopens the block, an attacker can execute arbitrary JavaScript on a victim’s browser when the vulnerable URL is visited. The vulnerability is classified as CWE‑79 and allows an attacker to run client‑side code, potentially hijacking user sessions, exfiltrating data, or delivering phishing content. The flaw is a client‑side only compromise; it does not grant the attacker server‑side privileges or direct access to system resources. The risk is moderate: the CVSS base score is 5.1, and the EPSS score is below 1%, indicating low probability of exploitation. At present the flaw is not in the CISA KEV catalog, and there is no public exploitation evidence. An attacker would need to convince a user to visit a maliciously crafted URL (e.g., phishing or social engineering).

The flaw affects Intermesh Group‑Office installations running any version prior to 6.8.155, 25.0.88, or 26.0.10. All components that expose the external/index endpoint are impacted; newer releases beyond those specified already contain the patch.

Attackers can exploit the flaw remotely by directing a victim to a forged external/index URL with a maliciously crafted f parameter. Because the input is unescaped in JavaScript, the attacker can inject code that runs in the victim’s browser context. Compromise requires user interaction, i.e., the victim browsing the crafted link. Given the low EPSS score, realistic exploitation will be rare unless the organization is targeted by a sophisticated attacker who can lure users to the malicious URL. The CVSS score of 5.1 indicates a medium severity risk that can compromise confidentiality and integrity of client data, but it does not provide a remote code execution vector or direct server access.