CVE-2025-54789
Medium
Description
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed in version 0.16.10.
SeverityMedium
CVSS6.1
Exploit probability—
Product
Humhub Files
PublishedAug 2, 2025
First seenAug 2, 2025
Weakness typeCWE-80CWE-80
How to fix
Update
- humhub files0.16.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| humhub files | v < 0.16.10 | 0.16.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.