Start your free trial today.

Protect your organization with cutting-edge cybersecurity solutions designed for resilience and efficiency. Secure your digital assets with confidence.

Your Shield Against Threats

Unleash the Power of Cybersecurity

Boost Your Security, Enhance Your Business

We solve Your Cyber Challenges

Quick Links

Resources

Deepaegis Portals

Vulnerability Advisory : Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php) with LOW Attack Complexity

Summary

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in the GroupOffice installer, endpoint install/license.php. The POST field license is rendered without escaping inside a <textarea>, allowing a </textarea><script>...</script> breakout.. This issue has been patched in versions 6.8.155, 25.0.88, and 26.0.10.

Impact Assessment

Timeline

Published

March 6, 2026

Last Modified

March 6, 2026

Related Advisories

breakout.. This issue has been patched in versions 6.8.155, 25.0.88, and 26.0.10.","datePublished":"2026-03-06T22:16:01.283Z","dateModified":"2026-03-06T22:16:01.283Z","author":{"@type":"Organization","name":"Deepaegis","url":"https://deepaegis?.io"},"publisher":{"@type":"Organization","name":"Deepaegis","logo":{"@type":"ImageObject","url":"https://deepaegis?.io/logo?.png"}},"mainEntityOfPage":{"@type":"WebPage","@id":"https://deepaegis?.io/vulnerability-advisories/group-office-self-xss-in-groupoffice-installer-license-page-installlicensephp"},"keywords":"CVE-2026-30237, , Intermesh, groupoffice"}