GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions

Description

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a stored and blind XSS vulnerability exists in the Phone Number field of the user profile within the GroupOffice application. This allows a malicious actor to inject persistent JavaScript payloads, which are triggered in the context of another user when they view the Address Book. Successful exploitation enables actions such as forced redirects, unauthorized fetch requests, or other arbitrary JavaScript execution without user interaction. Versions 6.8.119 and 25.0.20 contain a fix for the issue.

Scores

EPSS (exploitation in 30 days)

0.29% · top 78% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.

Weakness

• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs
• CWE-87: Improper Neutralization of Alternate XSS Syntax (opens in a new tab)All about CWE-87 and its CVEs

Affected products

• Intermesh · groupoffice

  • affected < 6.8.119
  • affected < 25.0.20

References (1)

• https://github.com/Intermesh/groupoffice/security/advisories/GHSA-phhq-3h8f-qxpx (opens in a new tab)x_refsource_CONFIRMexploit

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-48366](https://trackcve.app/badge/CVE-2025-48366.svg)](https://trackcve.app/cve/CVE-2025-48366)

Record last updated 22 May 2025, 17:55 UTC.