Stored Cross-Site Scripting in Intermesh Group-Office Email Viewer
CVE-2026-125389

5.3MEDIUM

Key Information:

Vendor

Intermesh

Status
Group-office
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125389?

Intermesh Group-Office versions prior to 6.8.181, 25.0.116, and 26.0.58 are susceptible to a stored cross-site scripting (XSS) vulnerability in the email viewer. This vulnerability arises from an inadequate regular expression in the StringHelper::filterXSS method, allowing attackers to embed malicious tags such as svg/onload within emails. When the affected emails are opened in the MessagePanel.js component, these scripts are executed within the recipient's session, posing significant security risks.

Affected Version(s)

Group-Office 0 < 6.8.181

Group-Office 25.0.0 < 25.0.116

Group-Office 26.0.0 < 26.0.58

References

https://github.com/Intermesh/groupoffice/security/advisor...
vendor-advisory
https://github.com/Intermesh/groupoffice/blob/v26.0.57/ww...
technical-description
https://github.com/Intermesh/groupoffice/commit/8e9ff5880...
patch

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
.