What is CVE-2026-23887?

CVE-2026-23887 is a medium-severity vulnerability in Group-office Group_office, classified under Improper Input Validation. CVSS score: 5.4/10. Published 2026-01-22.

How severe is CVE-2026-23887?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XSS in Group-office Group_office

CVE-2026-23887

Group-Office is an enterprise customer relationship management and groupware tool. In versions 6.8.148 and below, and 25.0.1 through 25.0.79, the application stores unsanitized filenames in the database, which can lead to Stored Cross-Site…

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.002 (15.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Group-office Group_office
Intermesh Groupoffice — versions < 6.8.149, >= 25.0.1, < 25.0.80

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2026-23887?: CVE-2026-23887 is a medium-severity vulnerability in Group-office Group_office, classified under Improper Input Validation. CVSS score: 5.4/10. Published 2026-01-22.
How severe is CVE-2026-23887?: Medium severity. CVSS v3 base score is 5.4 out of 10.