PT-2025-22529 · Unknown · Group-Office

Kh0Kamoni · Published 2025-05-22 · Updated 2025-05-30 · CVE-2025-48369

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Group-Office versions prior to 6.8.119 and 25.0.20

Description The issue is a persistent Cross-Site Scripting (XSS) vulnerability in Group-Office's tasks comment functionality. This allows attackers to execute arbitrary JavaScript by uploading a file with a crafted filename. When administrators or other users view the task containing this malicious file, the payload executes in their browser context. The application fails to sanitize image filenames before rendering them in the comment. By uploading an image with a crafted filename containing XSS payloads, attackers can steal sensitive information.

Recommendations For versions prior to 6.8.119, update to version 6.8.119 or later to resolve the issue. For versions prior to 25.0.20, update to version 25.0.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the tasks comment functionality until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-48369

GHSA-45JJ-R48J-75PP

Affected Products

Group-Office

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48369.json · Exploit
• 🔥 https://github.com/Intermesh/groupoffice/security/advisories/GHSA-45jj-r48j-75pp · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-48369 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48369 · Vendor Advisory
• https://twitter.com/dailycve/status/1928281256908767395 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1925757506535477385 · Twitter Post
• https://twitter.com/CVEnew/status/1925610243360174193 · Twitter Post