CVE-2025-48368 GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution

Medium 5.8 Published 22 May 2025 Updated 22 May 2025

Attackers can execute arbitrary JavaScript in victim browsers via DOM-based XSS in date fields, leading to session hijacking or data theft.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-48368?

CVE-2025-48368 is a medium-severity cross-site scripting vulnerability in Intermesh groupoffice, published on 22 May 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a DOM-based Cross-Site Scripting (XSS) vulnerability exists in the GroupOffice application, allowing attackers to execute arbitrary JavaScript code in the context of the victim's browser. This can lead to session hijacking, defacement, or redirection to malicious sites. The vulnerability can be triggered by injecting a crafted payload into a parameter that is later processed unsafely in the DOM. Versions 6.8.119 and 25.0.20 contain a fix for the issue.

Weakness: CWE-79

Which versions are affected by CVE-2025-48368?

It affects 1 product.

Products include Intermesh Group-Office.

How do I fix CVE-2025-48368?

No fix has been published for CVE-2025-48368 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-48368 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-48368 exists.

Sources

Also known as GHSA-c49j-qvp9-vgg6.