Read the docs
TI-2026-19245 Aliases CVE-2026-23887

Group-Office has stored XSS vulnerability via unsanitized filenames

Priority LOW 23CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Group-Office is an enterprise customer relationship management and groupware tool. In versions 6.8.148 and below, and 25.0.1 through 25.0.79, the application stores unsanitized filenames in the database, which can lead to Stored Cross-Site Scripting (XSS). Users who interact with these specially crafted file names within the Group-Office application are affected. While the scope is limited to the file-viewing context, it could still be used to interfere with user sessions or perform unintended actions in the browser. This issue is fixed in versions 6.8.149 and 25.0.80.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00274 19th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed groupoffice (Intermesh): 6.8.149, 25.0.80

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Intermeshgroupofficebefore 6.8.149; 25.0.1 to before 25.0.806.8.149, 25.0.80Patch availableCNA
  • groupoffice VendorIntermesh Affected before 6.8.149; 25.0.1 to before 25.0.80 Fixed in 6.8.149, 25.0.80 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:group-office:group_office:*:*:*:*:*:*:*:*before 6.8.149; 25.0.1 to before 25.0.80VulnerableGroup-office
  • cpe:2.3:a:group-office:group_office:*:*:*:*:*:*:*:* Versions before 6.8.149; 25.0.1 to before 25.0.80 Vulnerable ·Group-office

Remediation

  • Fix · CNA groupoffice (Intermesh) Fixed in 6.8.149, 25.0.80

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23887

References

Exploit 1

Patch 2

  • TI-2026-20622 Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler CVSS 4.0CRITICAL 9.4
  • TI-2018-16194 Path traversal in Intermesh Group-Office lets attackers read files CVSS 4.0HIGH 8.7
  • TI-2026-20621 Group-Office is vulnerable to SSRF and File Read in WOPI service discovery CVSS 4.0HIGH 8.2
  • TI-2023-25213 Server-Side Request Forgery in groupoffice CVSS 3.1HIGH 8.8
  • TI-2025-30692 GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions CVSS 4.0MEDIUM 6.9
  • TI-2025-18860 Group-Office has a Stored XSS Vulnerability via user's name field CVSS 4.0MEDIUM 6.9
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences