Vulnerability record/PUBLISHED/Published Nov 9, 2026 23:27:55 UTC

CVE-2026-125389

Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in the email viewer due to a flawed regex in StringHelper::filterXSS. Remote attackers can send emails containing tags like svg/onload, which MessagePanel.js renders raw, executing script in the recipient's session when opened.

Base score5.3/ 10

SeverityMediumCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorNetworkAV

Attack complexityLowAC

Attack requirementsNoneAT

Privileges requiredNonePR

User interactionPassiveUI

Vulnerable system confidentialityLowVC

Vulnerable system integrityLowVI

Vulnerable system availabilityNoneVA

Subsequent system confidentialityLowSC

Subsequent system integrityLowSI

Subsequent system availabilityNoneSA

CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityVulnCheck

Last updatedNov 9, 2026 23:27:55 UTC

PublishedNov 9, 2026 23:27:55 UTC

ReservedNov 9, 2026 22:03:11 UTC

Credits

leediay153 from Viettel Post