Open-Xchange OX App Suite Cross-Site Scripting Vulnerability via Uploaded Files

A cross-site scripting vulnerability has been identified in Open-Xchange OX App Suite. This issue allows malicious content uploaded as a file to execute script code when links controlled by the attacker are followed. The vulnerability affects several versions of OX App Suite office and backend. The unintended actions triggered by this vulnerability occur in the context of the user's account, potentially leading to the exfiltration of sensitive information.

Impact

Exploitation of this vulnerability could result in cross-site scripting, allowing for the execution of malicious scripts in the user's context.

Remediation

Users are advised to deploy the provided updates and patch releases. Instructions for updating can be found in the Open-Xchange OXAS-ADV-2025-0003 advisory.