File Move Vulnerability in Humhub Files Module

CVE-2025-54789

What is CVE-2025-54789?

The Files module in Humhub, utilized for file management within user profiles and spaces, has a significant vulnerability in versions 0.16.9 and earlier. The File Move functionality lacks proper safeguards against arbitrary JavaScript injection, potentially enabling unauthorized execution of JavaScript code within the user's browser session. This flaw could lead to severe implications, including unauthorized access and data manipulation. The issue has been addressed in version 0.16.10, making it crucial for users to upgrade to mitigate security risks.

References