CVE-2026-30237 in Group Office
Summary
by MITRE • 03/07/2026
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in the GroupOffice installer, endpoint install/license.php. The POST field license is rendered without escaping inside a <textarea>, allowing a </textarea><script>...</script> breakout.. This issue has been patched in versions 6.8.155, 25.0.88, and 26.0.10.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/12/2026
The vulnerability CVE-2026-30237 represents a critical reflected cross-site scripting flaw discovered in Group-Office, a widely-used enterprise customer relationship management and groupware platform. This security weakness specifically affects the installer component of the software, particularly the install/license.php endpoint where user input is processed. The vulnerability stems from inadequate input sanitization and output escaping mechanisms within the application's installation process, creating a pathway for malicious actors to inject arbitrary JavaScript code into the web interface. The flaw manifests when the POST parameter named 'license' is rendered within an HTML textarea element without proper HTML entity encoding, allowing attackers to exploit this weakness during the software installation phase.
The technical implementation of this vulnerability follows a classic reflected XSS pattern where malicious input can break out of the intended HTML context and execute within the victim's browser. When the license field value is submitted through the POST request to install/license.php, the application fails to properly escape special HTML characters including the closing tag sequence </textarea>. This allows an attacker to inject a complete </textarea><script>alert(1)</script> sequence that breaks out of the textarea element and executes JavaScript code in the context of the user's browser session. The vulnerability is particularly dangerous because it occurs during the installation process, when users may be less vigilant about security and the application is running with elevated privileges. This presents an opportunity for attackers to execute malicious scripts that could steal session cookies, redirect users to phishing sites, or perform other malicious activities.
The operational impact of this vulnerability extends beyond simple script execution, as it can be leveraged to compromise the entire installation process and potentially the underlying system. Attackers could use this vulnerability to inject malicious code that modifies the installation parameters, redirects users to malicious sites, or even establishes persistent backdoors within the Group-Office environment. The vulnerability affects multiple version streams of Group-Office, including the 6.8, 25.0, and 26.0 release lines, indicating a widespread exposure across different product lines. Given that the installer is typically accessed by system administrators or users with elevated privileges, successful exploitation could lead to complete system compromise. The vulnerability's presence during the installation phase makes it particularly attractive to attackers, as the target system is in a vulnerable state where users are actively engaged with the installation process.
Security practitioners should implement immediate mitigations including upgrading to the patched versions 6.8.155, 25.0.88, and 26.0.10 where the vulnerability has been addressed through proper input sanitization and output escaping. The fix involves implementing comprehensive HTML entity encoding for all user-supplied input before rendering it within HTML contexts, particularly within textarea elements. Organizations should also consider implementing additional security controls such as input validation, output encoding, and web application firewalls to protect against similar vulnerabilities. The vulnerability aligns with CWE-79, which specifically addresses cross-site scripting flaws, and represents a classic example of improper neutralization of input during web application development. From an ATT&CK framework perspective, this vulnerability maps to T1566.001 (Phishing: Spearphishing Attachment) and T1059.007 (Command and Scripting Interpreter: JavaScript) as it enables both initial access through malicious installation and execution of malicious code within the target environment. Organizations should conduct thorough security assessments of their Group-Office installations to ensure all affected versions have been properly updated and that no unauthorized modifications have been made to the installation process.