Reflected XSS Vulnerability in Group-Office Installer Affects Enterprise CRM Tools
CVE-2026-30237
What is CVE-2026-30237?
Group-Office, an enterprise CRM and groupware solution, has a reflected cross-site scripting vulnerability located in its installer. This vulnerability exists in versions prior to 6.8.155, 25.0.88, and 26.0.10 due to the lack of proper escaping in the installer script, specifically in the endpoint install/license.php. Specifically, the POST field 'license' can be manipulated to execute arbitrary scripts, creating a potential for malicious exploitation. Users are advised to upgrade to the patched versions to mitigate the risk associated with this vulnerability.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
groupoffice < 6.8.155 < 6.8.155
groupoffice < 25.0.88 < 25.0.88
groupoffice < 26.0.10 < 26.0.10