CVE-2025-54789 | THREATINT

Description

Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed in version 0.16.10.

PUBLISHED Reserved 2025-07-29 | Published 2025-08-01 | Updated 2025-08-04 | Assigner GitHub_M

MEDIUM: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Problem types

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Product status

< 0.6.10

affected

References

github.com/...cfiles/security/advisories/GHSA-cw2v-c62w-5r43

github.com/...ommit/f022bdd1cc54334a7a2a6f90a8168bb9583a2f00

github.com/humhub/cfiles/releases/tag/v0.16.10

cve.org (CVE-2025-54789)

nvd.nist.gov (CVE-2025-54789)

Download JSON