CVE-2026-23887

Group-Office is an enterprise customer relationship management and groupware tool. In versions 6.8.148 and below, and 25.0.1 through 25.0.79, the application stores unsanitized filenames in the database, which can lead to Stored Cross-Site Scripting (XSS). Users who interact with these specially crafted file names within the Group-Office application are affected. While the scope is limited to the file-viewing context, it could still be used to interfere with user sessions or perform unintended actions in the browser. This issue is fixed in versions 6.8.149 and 25.0.80.

• CWE-20
• CWE-79
• CWE-79

• https://github.com/Intermesh/groupoffice/commit/3fa40d7edd31fbe33babe07061d5a14ad19ea40fPatch
• https://github.com/Intermesh/groupoffice/commit/ac91b128157bc9c5ea015b6141ce71cd3bbc43f0Patch
• https://github.com/Intermesh/groupoffice/security/advisories/GHSA-3gj5-gvvr-g6hpExploit, Vendor Advisory

Published

Jan 22, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23881Kyverno is a policy engine designed for cloud native platfor…6.5
• CVE-2026-23882Blinko is an AI-powered card note-taking project. Prior to v…7.2
• CVE-2026-23883FreeRDP is a free implementation of the Remote Desktop Proto…9.8
• CVE-2026-23884FreeRDP is a free implementation of the Remote Desktop Proto…9.8
• CVE-2026-23885Alchemy is an open source content management system engine w…9.9
• CVE-2026-23886Swift W3C TraceContext is a Swift implementation of the W3C …5.3
• CVE-2026-23888pnpm is a package manager. Prior to version 10.28.1, a path …6.5
• CVE-2026-23889pnpm is a package manager. Prior to version 10.28.1, a path …6.5
• CVE-2026-2389The Complianz – GDPR/CCPA Cookie Consent plugin for WordPres…4.9
• CVE-2026-23890pnpm is a package manager. Prior to version 10.28.1, a path …6.5
• CVE-2026-23891Decidim is a participatory democracy framework. In versions …8.7
• CVE-2026-23892OctoPrint provides a web interface for controlling consumer …5.9