CVE-2026-125389: Group-Office before 6.8.181, 25.0.116, and 26.0.58 Stored XSS via filterXSS Bypass
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in the email viewer due to a flawed regex in StringHelper::filterXSS. Remote attackers can send emails containing tags like svg/onload, which MessagePanel.js renders raw, executing script in the recipient's session when opened.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Intermesh Group-Office versions earlier than 6.8.181, 25.0.116, and 26.0.58 are affected.
What does an attacker need to exploit this issue?
An attacker can exploit the issue remotely by sending a crafted email containing HTML such as an svg/onload tag. No attacker privileges are required, but the recipient must open the email in the vulnerable email viewer.
What is the likely impact on a recipient?
The crafted email can cause script to execute in the recipient's authenticated Group-Office session. The reported impact includes low confidentiality and integrity impact, with no availability impact.
What should be done if patching cannot happen immediately?
The provided information does not identify a workaround. Until an update is applied, treat untrusted HTML email as a potential trigger and avoid opening suspicious messages in the vulnerable email viewer.