CVE-2025-54789

MEDIUM

humhub/files < 0.16.10 - Stored Cross-Site Scripting via File Move Functionality

Title source: llm
STIX 2.1

Description

Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed in version 0.16.10.

References (3)

Core 3

Scores

CVSS v3 6.1
EPSS 0.0025
EPSS Percentile 16.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-80
Status published
Products (1)
humhub/files < 0.16.10
Published Aug 02, 2025
Tracked Since Feb 18, 2026