Open-Xchange OX App Suite Cross-Site Scripting Vulnerability via Malicious File Upload

A cross-site scripting vulnerability has been identified in Open-Xchange OX App Suite. This issue allows malicious content uploaded as a file to execute script code when users follow attacker-controlled links. The vulnerability can lead to unintended actions being performed in the context of the user's account, including the exfiltration of sensitive information. Affected products include OX App Suite office and backend versions 8.35, 8.39, 8.40, and 8.41. The vulnerability arises from improper neutralization of input during web page generation, allowing for cross-site scripting attacks.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's account, potentially leading to the exfiltration of sensitive information.

Remediation

Users are advised to update to the latest patch releases. Instructions for updating can be found in the Open-Xchange OXAS-ADV-2025-0003 security advisory.