CVE-2026-30237

Name of the Vulnerable Software and Affected Versions Group-Office versions prior to 6.8.155 Group-Office versions prior to 25.0.88 Group-Office versions prior to 26.0.10

Description Group-Office is a customer relationship management and groupware tool. A reflected cross-site scripting (XSS) issue exists in the GroupOffice installer at the install/license.php endpoint. The license POST parameter is rendered without proper escaping within a <textarea> element, enabling a </textarea><script>...</script> breakout.

Recommendations Update Group-Office to version 6.8.155 or later. Update Group-Office to version 25.0.88 or later. Update Group-Office to version 26.0.10 or later.