Persistent Cross-Site Scripting Vulnerability in Group-Office CRM by Intermesh

CVE-2025-48369

What is CVE-2025-48369?

A persistent Cross-Site Scripting (XSS) vulnerability affects Group-Office, an enterprise customer relationship management tool. Before versions 6.8.119 and 25.0.20, the application allows attackers to exploit the task comment functionality by uploading an image file with a crafted filename containing malicious JavaScript. When an administrator or user views the task, the malicious payload executes within their browser, potentially compromising sensitive information. This vulnerability arises due to inadequate sanitization of image filenames by the application prior to rendering them in user comments.

References