HumHub has 5 CVEs on record between 2025 and 2026. 2 were published in the last 90 days. The median CVSS is 6.5 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-79 (3). Most affected products: files (2), HumHub Community Edition (1), Humhub (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Worst active — by depth score
CVE-2026-115541High· 7.2HumHub 1.19.0 - Stored cross-site scripting in friendship confirmation40CVE-2026-93769High· 7.2HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a …40CVE-2025-54790Medium· 6.5Files is a module for managing files inside spaces and user profiles36CVE-2026-29052Medium· 6.1The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities34CVE-2025-54789Medium· 6.1Files is a module for managing files inside spaces and user profiles34
HumHub vulnerabilities
CVEs affecting HumHub, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-115541High· 7.2HumHub 1.19.0 - Stored cross-site scripting in friendship confirmation
HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated use…
CVE-2026-93769High· 7.2HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a …
HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a …
CVE-2026-29052Medium· 6.1The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities
The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities. Prior to version 1.8.11, a Stored Cross-Site Scripting (XSS) vulnerability …
CVE-2025-54790Medium· 6.5Files is a module for managing files inside spaces and user profiles
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, Files does not have logic to prevent the exploitation of backend SQL queries without direct output, potentially allowing unauthorized dat…
CVE-2025-54789Medium· 6.1Files is a module for managing files inside spaces and user profiles
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code exe…