CVE-2026-30238: Group-Office: Reflected XSS in JavaScript context
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in GroupOffice on the external/index flow. The f parameter (Base64 JSON) is decoded and then injected into an inline JavaScript block without strict escaping, allowing </script><script>...</script> injection and arbitrary JavaScript execution in the victim's browser. This issue has been patched in versions 6.8.155, 25.0.88, and 26.0.10.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30238?
CVE-2026-30238 is classified as a reflected cross-site scripting (XSS) vulnerability that can potentially impact user security.
How do I fix CVE-2026-30238?
To remediate CVE-2026-30238, update GroupOffice to versions 6.8.155, 25.0.88, or 26.0.10 or later.
What are the affected versions in CVE-2026-30238?
CVE-2026-30238 affects GroupOffice versions prior to 6.8.155, 25.0.88, and 26.0.10.
What is the impact of CVE-2026-30238?
The impact of CVE-2026-30238 could allow attackers to execute arbitrary JavaScript code in the context of a user's session.
Who is vulnerable to CVE-2026-30238?
Users of GroupOffice who are running versions prior to 6.8.155, 25.0.88, or 26.0.10 are vulnerable to CVE-2026-30238.