CVE-2026-125389
Group-Office before 6.8.181, 25.0.116, and 26.0.58 Stored XSS via filterXSS Bypass
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in the email viewer due to a flawed regex in StringHelper::filterXSS. Remote attackers can send emails containing tags like svg/onload, which MessagePanel.js renders raw, executing script in the recipient's session when opened.
| CWE | CWE-79 |
| Vendor | intermesh |
| Product | group-office |
| Published | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for intermesh group-office
Be the first to know when new medium vulnerabilities affecting intermesh group-office are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
Intermesh / Group-Office
0 < 6.8.181 25.0.0 < 25.0.116 26.0.0 < 26.0.58
References
github.com: https://github.com/Intermesh/groupoffice/security/advisories/GHSA-52gw-p4j3-v53c github.com: https://github.com/Intermesh/groupoffice/blob/v26.0.57/www/go/base/util/StringHelper.php#L799 github.com: https://github.com/Intermesh/groupoffice/commit/8e9ff58807c5cfa71a34a48d80410479c1e7f9f5 github.com: https://github.com/Intermesh/groupoffice/commit/bfc1fba43de53a6f662b1a12e31447a9c65d4d00 github.com: https://github.com/Intermesh/groupoffice/commit/f32e9674b162342f0e4a43932f4adaf03e97c755 vulncheck.com: https://www.vulncheck.com/advisories/group-office-before-6.8.181-25.0.116-and-26.0.58-stored-xss-via-filterxss-bypass
Credits
leediay153 from Viettel Post