2.1Low
CVE-2026-30237Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)
Description
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in the GroupOffice installer, endpoint install/license.php. The POST field license is rendered without escaping inside a <textarea>, allowing a </textarea><script>...</script> breakout.. This issue has been patched in versions 6.8.155, 25.0.88, and 26.0.10.
Weakness (CWE):
CWE-79
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| intermesh | group-office | < 6.8.155 | |
| Intermesh | groupoffice | < 6.8.155, < 25.0.88, < 26.0.10 |
References and patches
- https://github.com/Intermesh/groupoffice/security/advisories/GHSA-hchr-32xh-x5rx ExploitVendor Advisory
CPE matches (NVD) (3)
cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*< 6.8.155cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*≥ 25.0.1 < 25.0.88cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*≥ 25.2.1 < 26.0.10