GHSA-52gw-p4j3-v53c: Group-Office before 6.8.181, 25.0.116, and 26.0.58 Stored XSS via filterXSS Bypass
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in the email viewer due to a flawed regex in StringHelper::filterXSS. Remote attackers can send emails containing tags like svg/onload, which MessagePanel.js renders raw, executing script in the recipient's session when opened.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users of affected Group-Office versions are exposed when they open a malicious email in the email viewer. The payload executes in the recipient's authenticated browser session.
What does an attacker need to exploit this issue?
An attacker only needs to send an email containing a crafted HTML tag such as svg/onload. Exploitation requires the recipient to open that email; no attacker authentication is indicated.
How can I determine whether my deployment is affected?
Check the installed Group-Office version. Versions before 6.8.181, 25.0.116, and 26.0.58 are affected.