CVE-2025-53504: Group-Office XSS Vulnerability

CVE-2025-53504 Overview

CVE-2025-53504 is a cross-site scripting (XSS) vulnerability affecting Group-Office, a collaboration and CRM platform developed by Intermesh BV. The flaw resides in Group-Office versions prior to 6.8.119 and prior to 25.0.20. An authenticated attacker can inject arbitrary script that executes in a victim's browser session when the affected content is rendered. The issue is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation). Details are published in JVN Security Advisory JVN72111431.

Critical Impact
Successful exploitation allows execution of arbitrary JavaScript in a targeted user's browser, enabling session data theft, UI manipulation, or actions performed as the victim within the Group-Office application.

Affected Products

Group-Office versions prior to 6.8.119
Group-Office versions prior to 25.0.20
Vendor: Intermesh BV (Group-Office)

Discovery Timeline

2025-08-21 - CVE-2025-53504 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53504

Vulnerability Analysis

The vulnerability is a stored or reflected cross-site scripting flaw within the Group-Office web application. Group-Office fails to properly neutralize user-supplied input before including it in web pages served to other users. When a victim loads a page containing the attacker-controlled payload, the browser interprets the injected content as executable script.

Exploitation requires that a user interact with the malicious content, and the attacker must hold low-level authenticated access to the application. Because Group-Office is a collaboration suite handling email, contacts, files, and CRM data, script execution within an authenticated session can expose sensitive business data.

Root Cause

The root cause is improper output encoding of user-controlled data rendered by the Group-Office web interface. Input accepted through application fields is not sanitized or escaped before being emitted into the HTML response, allowing HTML and JavaScript tokens to break out of their intended data context.

Attack Vector

The attack is delivered over the network against the Group-Office web interface. An authenticated attacker submits a payload containing script content into an affected field. When another user views the affected view, the browser executes the injected code with the privileges of that user's Group-Office session. See JVN72111431 for advisory details.

// No verified public proof-of-concept is available for CVE-2025-53504.
// Refer to the JVN advisory for technical specifics.

Detection Methods for CVE-2025-53504

Indicators of Compromise

Group-Office records or messages containing HTML tags such as <script>, <img onerror=...>, or javascript: URIs in fields expected to hold plain text.
Web server access logs showing POST requests to Group-Office endpoints with payloads containing encoded script characters (%3Cscript%3E, <script>).
Unusual outbound requests from user browsers to attacker-controlled domains shortly after loading Group-Office pages.

Detection Strategies

Inspect stored Group-Office database content for HTML or JavaScript tokens in fields intended for text data.
Deploy a web application firewall rule to flag XSS payload signatures targeting Group-Office endpoints.
Correlate authentication events with anomalous session activity or credential reuse originating from Group-Office user contexts.

Monitoring Recommendations

Enable verbose HTTP access logging on the Group-Office web server and forward logs to a centralized analytics platform.
Monitor Content Security Policy (CSP) violation reports for blocked inline script execution attempts.
Alert on Group-Office user sessions performing unexpected administrative actions or bulk data access.

How to Mitigate CVE-2025-53504

Immediate Actions Required

Upgrade Group-Office to version 6.8.119 or 25.0.20 (or later) as published by Intermesh BV.
Audit existing Group-Office records for previously injected script content and sanitize affected entries.
Rotate session tokens and require re-authentication for all Group-Office users following the upgrade.

Patch Information

Intermesh BV has released fixed builds addressing CVE-2025-53504. Administrators should install Group-Office 6.8.119 for the 6.x branch or 25.0.20 for the 25.x branch. Consult the Group-Office official website for release artifacts and the JVN advisory JVN72111431 for coordination details.

Workarounds

Restrict Group-Office access to trusted networks using VPN or IP allow-listing until patching is complete.
Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources.
Limit account creation and reduce the privileges of low-trust users to lower the exposure surface for stored XSS.

bash

# Example: enforce a restrictive Content Security Policy header at the reverse proxy
# nginx configuration snippet
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;