PT-2026-141212

CVE-2026-125389

Published

2026-11-09

Updated

2026-11-10

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Intermesh Group-Office versions prior to 6.8.181 Intermesh Group-Office versions prior to 25.0.116 Intermesh Group-Office versions prior to 26.0.58

Description A stored cross-site scripting issue exists in the email viewer caused by a flawed regular expression in the filterXSS() function within StringHelper. Remote attackers can send emails containing malicious tags, such as svg/onload, which are rendered raw by MessagePanel.js. This allows the execution of arbitrary scripts within the session of the recipient when the email is opened.

Recommendations Update to version 6.8.181 or later. Update to version 25.0.116 or later. Update to version 26.0.58 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2026-125389