Vulnerability Description
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed in version 0.16.10.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Humhub | Files | < 0.16.10 |
Related Weaknesses (CWE)
References
- https://github.com/humhub/cfiles/commit/f022bdd1cc54334a7a2a6f90a8168bb9583a2f00Patch
- https://github.com/humhub/cfiles/releases/tag/v0.16.10Release Notes
- https://github.com/humhub/cfiles/security/advisories/GHSA-cw2v-c62w-5r43Vendor Advisory
FAQ
What is CVE-2025-54789?
CVE-2025-54789 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, ...
How severe is CVE-2025-54789?
CVE-2025-54789 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-54789?
Check the references section above for vendor advisories and patch information. Affected products include: Humhub Files.