# CVE-2026-125389: Intermesh Group-Office stored XSS in email viewer

Source: https://junglewise.ai/threats/cve-2026-125389-intermesh-group-office-before-6-8-181-25-0-116-and-26-0-58  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125389 · Severity: medium · CVSS 6.1 · Published 2026-11-10

Group-Office is a collaborative business software suite for email, calendar, and document management. A flaw in the email viewer's HTML sanitization allows attackers to send specially crafted emails containing malicious script tags that execute in recipients' sessions when the email is opened, potentially leading to account compromise or data theft.

Technologies: [Intermesh Group-Office](https://junglewise.ai/threats/technologies/group-office). Vendors: [Intermesh](https://junglewise.ai/threats/vendors/intermesh).

## Quick answers

**Is CVE-2026-125389 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125389 being exploited in the wild.

**How severe is CVE-2026-125389?** Medium severity, with a CVSS score of 6.1, published 10 November 2026.

**Which products and versions are affected?** Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58.

**Is there a fix for CVE-2026-125389?** Yes: fixed in 6.8.181, 25.0.116, 26.0.58. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-125389?** Check whether you run Intermesh Group-Office at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.8.181, 25.0.116, 26.0.58

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the email viewer caused by a flawed regex in StringHelper::filterXSS(). Remote attackers can send emails with SVG/onload event handlers or other script tags that bypass the sanitization filter and are rendered raw by MessagePanel.js, executing arbitrary JavaScript in the recipient's browser context. The fix replaces regex-based sanitization with DOM-based HTML parsing to properly strip event handlers and script elements.

## Affected products

- Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58

## References

- [https://github.com/Intermesh/groupoffice/blob/v26.0.57/www/go/base/util/StringHelper.php](https://github.com/Intermesh/groupoffice/blob/v26.0.57/www/go/base/util/StringHelper.php)
- [https://github.com/Intermesh/groupoffice/commit/8e9ff58807c5cfa71a34a48d80410479c1e7f9f5](https://github.com/Intermesh/groupoffice/commit/8e9ff58807c5cfa71a34a48d80410479c1e7f9f5)

## Related threats

- [Group-Office server-side request forgery in Bookmark description](https://junglewise.ai/threats/cve-2026-63653-group-office-is-an-enterprise-customer-relationship-management)
- [Group-Office template injection in Contact/labels JMAP endpoint](https://junglewise.ai/threats/cve-2026-63011-group-office-is-an-enterprise-customer-relationship-management)
- [Group-Office stored XSS in reminders via HTML/JavaScript injection](https://junglewise.ai/threats/cve-2026-63010-group-office-is-an-enterprise-customer-relationship-management)
- [Group-Office arbitrary local file read in FolderController](https://junglewise.ai/threats/cve-2026-125390-group-office-before-6-8-181-25-0-116-and-26-0-58-contains-an)
- [Intermesh Group-Office missing authorization in form report download](https://junglewise.ai/threats/cve-2026-125388-intermesh-group-office-before-6-8-181-25-0-116-and-26-0-58)