Cross-Site Scripting in HumHub Button Component
CVE-2026-29048

6.9MEDIUM

Key Information:

Vendor

Humhub

Status
Humhub
Vendor
CVE Published:
6 March 2026

What is CVE-2026-29048?

In version 1.18.0 of HumHub, a cross-site scripting vulnerability was found in the Button component due to inconsistent output encoding. This flaw allows attackers to inject malicious scripts that can be executed in users' browsers, compromising their security. The issue has been addressed in version 1.18.1, and users are encouraged to update their installations to mitigate potential risks.

Affected Version(s)

humhub = 1.18.0

References

https://github.com/humhub/humhub/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/humhub/humhub/pull/8039
x_refsource_MISC
https://github.com/humhub/humhub/commit/bd06ab4c75f6c6529...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.