CVE-2026-18430CWE-79cross-site-scripting

CVE-2026-18430

published August 19, 2026

CVSS

7.2

EPSS

Percentile

42.0

In the wild

Unconfirmed

What it is

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason.

The record

Technical detail

CVSS: 7.2 · NONE
CVSS v4.0: 7.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
EPSS: 0.00501 · 42.0th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2026-08-19T20:17Z

References (4)

https://fluidattacks.com/es/advisories/personajes · [email protected]https://github.com/humhub/humhub · [email protected]https://github.com/humhub/humhub/pull/8365 · [email protected]https://fluidattacks.com/es/advisories/personajes · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

19 AUG 15:52Z
HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason
cvelistv5