Start your free trial today.

Protect your organization with cutting-edge cybersecurity solutions designed for resilience and efficiency. Secure your digital assets with confidence.

Your Shield Against Threats

Unleash the Power of Cybersecurity

Boost Your Security, Enhance Your Business

We solve Your Cyber Challenges

Quick Links

Resources

Deepaegis Portals

Vulnerability Advisory : Group-Office: Reflected XSS in JavaScript context with LOW Attack Complexity

Summary

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in GroupOffice on the external/index flow. The f parameter (Base64 JSON) is decoded and then injected into an inline JavaScript block without strict escaping, allowing </script><script>...</script> injection and arbitrary JavaScript execution in the victim's browser. This issue has been patched in versions 6.8.155, 25.0.88, and 26.0.10.

Impact Assessment

Timeline

Published

March 6, 2026

Last Modified

March 6, 2026

Related Advisories

injection and arbitrary JavaScript execution in the victim's browser. This issue has been patched in versions 6.8.155, 25.0.88, and 26.0.10.","datePublished":"2026-03-06T22:16:01.437Z","dateModified":"2026-03-06T22:16:01.437Z","author":{"@type":"Organization","name":"Deepaegis","url":"https://deepaegis?.io"},"publisher":{"@type":"Organization","name":"Deepaegis","logo":{"@type":"ImageObject","url":"https://deepaegis?.io/logo?.png"}},"mainEntityOfPage":{"@type":"WebPage","@id":"https://deepaegis?.io/vulnerability-advisories/group-office-reflected-xss-in-javascript-context"},"keywords":"CVE-2026-30238, , Intermesh, groupoffice"}