CVE-2025-64781 Open redirect in GroupSession Free edition
Attackers can redirect users to arbitrary websites via crafted URLs due to insecure default external page display restrictions in GroupSession.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-64781?
CVE-2025-64781 is a medium-severity vulnerability in Japan Total System Co.,Ltd. GroupSession Free edition, published on 12 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, "External page display restriction" is set to "Do not limit" in the initial configuration. With this configuration, the user may be redirected to an arbitrary website when accessing a specially crafted URL.
Weakness: CWE-1188
Which versions are affected by CVE-2025-64781?
It affects 1 product.
Products include Groupsession Groupsession.
How do I fix CVE-2025-64781?
No fix has been published for CVE-2025-64781 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-64781 being exploited?
There is no known exploitation of CVE-2025-64781 in the wild and no public exploit code.
Other vulnerabilities in Japan Total System Co.,Ltd. GroupSession Free edition
- CVE-2021-20874 Missing authorization in GroupSession Free edition, GroupSession byCloud, GroupSession ZION
- CVE-2025-61987 Cross-site request forgery in GroupSession Free edition
- CVE-2021-20876 Path traversal in GroupSession Free edition, GroupSession byCloud, GroupSession ZION
- CVE-2017-2165 Information disclosure in GroupSession
- CVE-2021-20875 Open redirect in GroupSession Free edition, GroupSession byCloud, GroupSession ZION
Sources
Also known as GHSA-778m-x6m8-v6h8.