PT-2025-25601 · Unknown · Group-Office

Kh0Kamoni · Published 2025-06-17 · Updated 2025-06-17 · CVE-2025-48993

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Group-Office versions prior to 6.8.123 and 25.0.27

Description The issue is related to a reflected cross-site scripting (XSS) attack. A malicious JavaScript payload can be executed via the Look and Feel formatting fields. Any user can update their Look and Feel Formatting input fields, but the web application does not sanitize their input.

Recommendations For versions prior to 6.8.123, update to version 6.8.123 or later. For versions prior to 25.0.27, update to version 25.0.27 or later. As a temporary workaround, consider restricting access to the Look and Feel formatting fields until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-48993

GHSA-XV2X-V374-92GV

Affected Products

Group-Office

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48993.json · Exploit
• https://github.com/Intermesh/groupoffice/commit/a9031884f6a6fbd0f08a8b7790514b5bc0937c11 · Patch
• https://github.com/Intermesh/groupoffice/commit/1e2a2450f204174f87a93217838d74718996dcdd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-48993 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48993 · Vendor Advisory
• https://github.com/Intermesh/groupoffice/security/advisories/GHSA-xv2x-v374-92gv · Note
• https://twitter.com/VulmonFeeds/status/1934802335890342020 · Twitter Post
• https://twitter.com/CVEnew/status/1934780726395769314 · Twitter Post