PT-2026-3883 · Unknown · Group-Office

Jaroslaw-Wawiorko · Published 2026-01-21 · Updated 2026-02-18 · CVE-2026-23887

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Group-Office versions 6.8.148 and below Group-Office versions 25.0.1 through 25.0.79

Description Group-Office, an enterprise customer relationship management and groupware tool, stores unsanitized filenames in the database. This can lead to Stored Cross-Site Scripting (XSS) when users interact with these crafted filenames within the application. The impact is limited to the file-viewing context, potentially allowing interference with user sessions or unintended actions in the browser.

Recommendations Update Group-Office to version 6.8.149 or later. Update Group-Office to version 25.0.80 or later.

Exploit

Fix

XSS

RCE

Weakness Enumeration

CWE-79

CWE-20

Related Identifiers

CVE-2026-23887

GHSA-3GJ5-GVVR-G6HP

Affected Products

Group-Office

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23887.json · Exploit
• https://github.com/Intermesh/groupoffice/security/advisories/GHSA-3gj5-gvvr-g6hp · Vendor Advisory
• https://github.com/Intermesh/groupoffice/commit/3fa40d7edd31fbe33babe07061d5a14ad19ea40f · Patch
• https://github.com/Intermesh/groupoffice/commit/ac91b128157bc9c5ea015b6141ce71cd3bbc43f0 · Patch
• https://osv.dev/vulnerability/CVE-2026-23887 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23887 · Security Note
• https://t.me/cveNotify/152323 · Telegram Post
• https://twitter.com/CVEnew/status/2014125835154870476 · Twitter Post
• https://twitter.com/lsof/status/2014399023780708727 · Twitter Post
• https://t.me/cveNotify/149497 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2014171822564987061 · Twitter Post