CVE-2025-48993

Name of the Vulnerable Software and Affected Versions Group-Office versions prior to 6.8.123 and 25.0.27

Description The issue is related to a reflected cross-site scripting (XSS) attack. A malicious JavaScript payload can be executed via the Look and Feel formatting fields. Any user can update their Look and Feel Formatting input fields, but the web application does not sanitize their input.

Recommendations For versions prior to 6.8.123, update to version 6.8.123 or later. For versions prior to 25.0.27, update to version 25.0.27 or later. As a temporary workaround, consider restricting access to the Look and Feel formatting fields until a patch is applied.