CVE-2025-54789CWE-80

CVE-2025-54789

Medium · published August 2, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
21.5
In the wild
Unconfirmed
What it is

Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed in version 0.16.10.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00300 · 21.5th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2025-08-02T04:15Z
Affected products (1)
ProductVersionsFixed in
humhub/files< 0.16.100.16.10
References (3)
https://github.com/humhub/cfiles/commit/f022bdd1cc54334a7a2a6f90a8168bb9583a2f00 · [email protected]https://github.com/humhub/cfiles/releases/tag/v0.16.10 · [email protected]https://github.com/humhub/cfiles/security/advisories/GHSA-cw2v-c62w-5r43 · [email protected]
EPSS history
Timeline
  • 01 AUG 23:26Z
    Files is Vulnerable to Reflected Self-XSS through its File Move Functionality
    cvelistv5