CVE-2026-30237CWE-79

Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)

Low · published March 6, 2026

CVSS v4.0
2.1
EPSS
0%
Percentile
18.4
In the wild
Unconfirmed
What it is

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in the GroupOffice installer, endpoint install/license.php. The POST field license is rendered without escaping inside a <textarea>, allowing a </textarea><script>...</script> breakout.. This issue has been patched in versions 6.8.155, 25.0.88, and 26.0.10.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00271 · 18.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-06T21:13Z
EPSS history
Timeline
  • 06 MAR 21:13Z
    Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)
    cvelistv5