CVE-2025-48369: GroupOffice vulnerable to Stored XSS in Tasks Comment Section
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a persistent Cross-Site Scripting (XSS) vulnerability exists in Groupoffice's tasks comment functionality, allowing attackers to execute arbitrary JavaScript by uploading an file with a crafted filename. When administrators or other users view the task containing this malicious file, the payload executes in their browser context. The application fails to sanitize image filenames before rendering them in the comment. By uploading an image with a crafted filename containing XSS payloads, attackers can steal sensitive information. Versions 6.8.119 and 25.0.20 contain a fix for the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48369?
CVE-2025-48369 is classified as a high severity Cross-Site Scripting (XSS) vulnerability that affects earlier versions of GroupOffice.
How do I fix CVE-2025-48369?
To mitigate CVE-2025-48369, you should upgrade to GroupOffice versions 6.8.119 or 25.0.20 or later.
What is the impact of CVE-2025-48369?
CVE-2025-48369 allows attackers to execute arbitrary JavaScript code via the tasks comment functionality, potentially compromising user accounts and data.
Which versions of GroupOffice are affected by CVE-2025-48369?
CVE-2025-48369 affects GroupOffice versions prior to 6.8.119 and 25.0.20.
Is there a workaround for CVE-2025-48369?
There are no known workarounds for CVE-2025-48369, so upgrading to a secure version is the recommended solution.