CVE-2025-54789: humhub files

csirt@kutim:~/threat-intel/cve/CVE-2025-54789

CVSS 6.1 · Medium EPSS 0,28%

Kerentanan Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) pada humhub files. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed in version 0.16.10.

Rincian

Terbit di NVD: 2 Agustus 2025
Terakhir diubah: 2 September 2026
Status NVD: Analyzed
CVSS 3.1: 6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
EPSS (30 hari): 0,28% peluang dieksploitasi; lebih tinggi dari 18,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
humhub	files	Semua versi sebelum 0.16.10

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/humhub/cfiles/security/advisories/GHSA-cw2v-c62w-5r43 advisory vendor
https://github.com/humhub/cfiles/commit/f022bdd1cc54334a7a2a6f90a8168bb9583a2f00 patch
https://github.com/humhub/cfiles/releases/tag/v0.16.10 release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.