CVE-2026-30237: Group-Office Reflected XSS Vulnerability

CVE-2026-30237 Overview

Group-Office is an enterprise customer relationship management and groupware tool developed by Intermesh. A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the GroupOffice installer, specifically in the install/license.php endpoint. The POST field license is rendered without proper escaping inside a <textarea> element, allowing attackers to break out of the textarea context and inject malicious JavaScript code.

Critical Impact

Attackers can exploit this reflected XSS vulnerability to execute arbitrary JavaScript in the context of a victim's browser session during the installation process, potentially leading to session hijacking, credential theft, or malicious actions performed on behalf of authenticated users.

Affected Products

• Intermesh Group-Office versions prior to 6.8.155
• Intermesh Group-Office versions prior to 25.0.88
• Intermesh Group-Office versions prior to 26.0.10

Discovery Timeline

• 2026-03-06 - CVE-2026-30237 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-30237

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw exists in the installer component of Group-Office, specifically within the license handling functionality.

The vulnerability occurs because user-supplied input in the license POST parameter is directly rendered within a <textarea> HTML element without proper output encoding or sanitization. This allows an attacker to craft a malicious payload that closes the textarea element prematurely and injects arbitrary HTML or JavaScript code.

The attack requires user interaction, as the victim must be tricked into submitting a specially crafted form or clicking a malicious link that targets the vulnerable endpoint during the Group-Office installation process.

Root Cause

The root cause of this vulnerability is improper output encoding in the install/license.php file. When the application receives the license parameter via POST request, it directly embeds the value into the HTML response within a <textarea> tag without escaping HTML special characters. This allows an attacker to use a payload containing </textarea> to break out of the intended context and inject malicious script tags or other HTML content.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker must craft a malicious request targeting the install/license.php endpoint and convince a victim (typically an administrator performing installation) to trigger it.

The exploitation technique involves:

1. The attacker crafts a POST request with a malicious license parameter containing a textarea breakout sequence followed by script injection
2. The payload structure follows the pattern: </textarea><script>malicious_code</script>
3. When the server processes this input, it renders the unescaped content inside the textarea element
4. The browser interprets the injected content as valid HTML/JavaScript, executing the attacker's code

Since this vulnerability affects the installer component, the attack surface is limited to the installation phase. However, installations that leave the install/ directory accessible after setup remain vulnerable.

Detection Methods for CVE-2026-30237

Indicators of Compromise

• Monitor HTTP POST requests to install/license.php containing suspicious patterns such as </textarea> or <script> tags
• Watch for unusual requests to the /install/ directory from external IP addresses
• Review web server access logs for requests to installation endpoints that should have been removed post-installation
• Check for encoded variations of XSS payloads targeting textarea breakout patterns

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block XSS patterns in POST parameters, particularly those targeting textarea element breakouts
• Implement Content Security Policy (CSP) headers to mitigate the impact of successful XSS exploitation
• Configure intrusion detection systems to alert on requests containing common XSS payload signatures targeting the /install/ path
• Use browser-based XSS auditor logging to identify potential exploitation attempts

Monitoring Recommendations

• Enable detailed logging for the Group-Office installation directory and monitor for unexpected access patterns
• Set up alerts for any POST requests to install/license.php in production environments where installation should be complete
• Monitor for JavaScript execution errors that may indicate blocked XSS attempts when CSP is properly configured
• Regularly audit web server configurations to ensure installation directories are properly secured or removed

How to Mitigate CVE-2026-30237

Immediate Actions Required

• Upgrade Group-Office to patched versions: 6.8.155, 25.0.88, or 26.0.10 depending on your release branch
• Remove or restrict access to the /install/ directory after installation is complete
• Implement Web Application Firewall rules to filter XSS payloads targeting the vulnerable endpoint
• Conduct a security review to verify the installation directory is not publicly accessible

Patch Information

Intermesh has released security patches addressing this vulnerability in versions 6.8.155, 25.0.88, and 26.0.10. Users should update to the appropriate patched version for their release branch immediately. Detailed information about the fix is available in the GitHub Security Advisory.

Workarounds

• Remove or rename the /install/ directory immediately after completing Group-Office installation
• Restrict access to the installation directory using web server configuration (e.g., Apache .htaccess or Nginx location blocks) to allow only authorized IP addresses
• Implement strict Content Security Policy headers to prevent inline script execution as a defense-in-depth measure
• Use network-level access controls to limit who can reach the installation endpoints

# Apache: Restrict access to install directory
<Directory "/path/to/groupoffice/install">
    Require ip 127.0.0.1
    Require ip 10.0.0.0/8
</Directory>

# Nginx: Block access to install directory
location /install {
    deny all;
    return 403;
}