Vulnerability · Published Aug 1, 2025 · Assigned by GitHub_M
CVE-2025-54789Files is Vulnerable to Reflected Self-XSS through its File Move Functionality
Medium 5.1
In plain English
A medium-severity security flaw in cfiles from humhub. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Severity (CVSS 4.0)5.1Medium
Exploit odds (30 days)0.3%top 74.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed in version 0.16.10.
Affected products (as reported)
Weakness: CWE-80 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
References
- https://github.com/humhub/cfiles/security/advisories/GHSA-cw2v-c62w-5r43 x_refsource_CONFIRM
- https://github.com/humhub/cfiles/commit/f022bdd1cc54334a7a2a6f90a8168bb9583a2f00 x_refsource_MISC
- https://github.com/humhub/cfiles/releases/tag/v0.16.10 x_refsource_MISC