CVE-2025-48993: Group-Office vulnerable to reflected XSS via Look and Feel Formatting input
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a malicious JavaScript payload can be executed via the Look and Feel formatting fields. Any user can update their Look and Feel Formatting input fields, but the web application does not sanitize their input. This could result in a reflected cross-site scripting (XSS) attack. This issue has been patched in versions 6.8.123 and 25.0.27.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48993?
The severity of CVE-2025-48993 is classified as high due to the potential for executing malicious JavaScript payloads.
How do I fix CVE-2025-48993?
To fix CVE-2025-48993, upgrade to Group-Office versions 6.8.123 or 25.0.27 or later.
Who is affected by CVE-2025-48993?
Any user of Group-Office versions prior to 6.8.123 and 25.0.27 is vulnerable to CVE-2025-48993.
What type of vulnerability is CVE-2025-48993?
CVE-2025-48993 is a cross-site scripting (XSS) vulnerability that allows execution of malicious scripts.
What components of Group-Office are affected by CVE-2025-48993?
The Look and Feel formatting fields in Group-Office are the specific components affected by CVE-2025-48993.