CVE-2025-65963CWE-284CWE-285broken-access-control

CVE-2025-65963

Medium · published November 26, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
7.1
In the wild
Unconfirmed
What it is

Files is a module for managing files inside spaces and user profiles. Prior to versions 0.16.11 and 0.17.2, insufficient authorization checks allow non-member users to create new folders, up- and download files as a ZIP archive in public spaces. Private spaces are not affected. This issue has been patched in versions 0.16.11 and 0.17.2.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00180 · 7.1th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-285 · Improper Authorization
Published
2025-11-26T05:15Z
References (2)
https://github.com/humhub/cfiles/commit/75698f8e8f360cea470f0e9f264015b697ab4c09 · [email protected]https://github.com/humhub/cfiles/security/advisories/GHSA-rv2x-7qwp-2hf4 · [email protected]
EPSS history
Timeline
  • 25 NOV 23:38Z
    CFiles Unauthorized Folder/ZIP Access in Public Spaces
    cvelistv5