CVE-2025-54789
Files is Vulnerable to Reflected Self-XSS through its File Move Functionality
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Files is Vulnerable to Reflected Self-XSS through its File Move Functionality
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed in version 0.16.10.
Reserved 2025-07-29 | Published 2025-08-01 | Updated 2025-08-01 | Assigner GitHub_MCWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
github.com/...cfiles/security/advisories/GHSA-cw2v-c62w-5r43
github.com/...ommit/f022bdd1cc54334a7a2a6f90a8168bb9583a2f00
github.com/humhub/cfiles/releases/tag/v0.16.10
Support options
