CVE-2025-48366 Overview
CVE-2025-48366 is a stored and blind cross-site scripting (XSS) vulnerability in Group-Office, an enterprise customer relationship management (CRM) and groupware platform developed by Intermesh. The flaw resides in the Phone Number field of the user profile. An authenticated attacker can inject persistent JavaScript payloads that execute when another user views the Address Book. Exploitation requires no interaction from the victim beyond opening the affected view. Versions prior to 6.8.119 and 25.0.20 are affected. The issue is classified as [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Attackers can execute arbitrary JavaScript in the context of victim users, enabling forced redirects, unauthorized fetch requests, and session-based follow-on actions without user interaction.
Affected Products
- Intermesh Group-Office versions prior to 6.8.119
- Intermesh Group-Office 25.x versions prior to 25.0.20
- Group-Office deployments exposing the user profile Phone Number field and Address Book module
Discovery Timeline
- 2025-05-22 - CVE-2025-48366 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-48366
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the Group-Office user profile. The Phone Number field accepts unsanitized input and stores it in the application database. When another user opens the Address Book, the stored payload is rendered without proper output encoding. The browser executes the injected JavaScript in the context of the viewing user's session.
Because the payload triggers in the Address Book view, exploitation is blind from the attacker's perspective. Any Group-Office user with permission to edit their profile can plant a payload. Any user with Address Book access becomes a potential victim, including administrators. This asymmetry raises the operational impact of the flaw, since low-privileged accounts can target higher-privileged users.
Root Cause
The root cause is missing input validation and output encoding on the Phone Number profile attribute. The application treats the field as trusted string data rather than untrusted user input. When the Address Book renders contact records, the field is inserted into the Document Object Model (DOM) without HTML entity escaping. This allows <script> tags and event handler attributes to execute.
Attack Vector
The attack vector is network-based and requires the attacker to hold a valid Group-Office account. The attacker edits their own profile, submits a JavaScript payload in the Phone Number field, and waits for a victim to browse the Address Book. Once triggered, the payload runs with the victim's cookies and privileges. Possible actions include exfiltrating session tokens, issuing authenticated API calls, redirecting to attacker-controlled hosts, or planting additional payloads across the tenant. See the GitHub Security Advisory GHSA-phhq-3h8f-qxpx for vendor-provided technical detail.
Detection Methods for CVE-2025-48366
Indicators of Compromise
- Unusual characters such as <, >, ", or script substrings stored in the phone or contact number columns of the Group-Office database.
- Outbound requests from user browsers to unfamiliar domains immediately after Address Book access.
- Unexpected fetch or XMLHttpRequest traffic originating from authenticated Group-Office sessions.
Detection Strategies
- Query the Group-Office user and address book tables for phone fields containing HTML tags, JavaScript URI schemes, or event handler patterns.
- Review web server access logs for profile update requests containing script-like payloads in the phone parameter.
- Enable and monitor Content Security Policy (CSP) violation reports to flag inline script execution in Address Book views.
Monitoring Recommendations
- Alert on Group-Office profile modification events that include characters commonly used in XSS payloads.
- Monitor administrator sessions for anomalous API calls that occur in temporal proximity to Address Book page loads.
- Track browser telemetry for redirects and cross-origin requests generated from Group-Office origins.
How to Mitigate CVE-2025-48366
Immediate Actions Required
- Upgrade Group-Office to version 6.8.119 or 25.0.20 or later without delay.
- Audit existing user profiles and address book entries for stored payloads and sanitize any suspicious values.
- Rotate session cookies and force reauthentication for accounts that may have viewed poisoned Address Book entries.
Patch Information
Intermesh released fixed builds in Group-Office 6.8.119 and 25.0.20. Both versions address the stored XSS by applying proper output encoding to the Phone Number field. Consult the Intermesh GitHub Security Advisory for release notes and upgrade guidance.
Workarounds
- Restrict profile edit permissions to trusted user groups until patches are applied.
- Deploy a strict Content Security Policy that disallows inline scripts on Group-Office origins.
- Place Group-Office behind a web application firewall (WAF) with rules that block script tags and JavaScript URIs in profile update requests.
# Example WAF rule concept blocking script content in phone parameters
# ModSecurity-style pseudo-rule
SecRule ARGS:phone "@rx (?i)(<script|javascript:|on\w+\s*=)" \
"id:1004836,phase:2,deny,status:403,msg:'Group-Office XSS payload in phone field'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
