---
id: CVE-2025-54790
title: Files is a module for managing files inside spaces and user profiles
summary: >-
  Files is a module for managing files inside spaces and user profiles. In
  versions 0.16.9 and below, Files does not have logic to prevent the
  exploitation of backend SQL queries without direct output, potentially
  allowing unauthorized dat…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-89
vendor: humhub
product: files
affected:
  - files < 0.16.10
patched:
  - files 0.16.10
published: '2025-08-02'
updated: '2026-09-02'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-54790'
references:
  - url: 'https://github.com/humhub/cfiles/pull/252'
    label: security-advisories@github.com
  - url: 'https://github.com/humhub/cfiles/releases/tag/v0.16.10'
    label: security-advisories@github.com
  - url: 'https://github.com/humhub/cfiles/security/advisories/GHSA-rfvq-g9rm-pgqj'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00306
epssPercentile: 0.2099
ingestedAt: '2026-09-02T14:45:28.002Z'
---

## Overview

Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, Files does not have logic to prevent the exploitation of backend SQL queries without direct output, potentially allowing unauthorized data access. This is fixed in version 0.16.10.

## Affected

- `files < 0.16.10`

## Remediation

Upgrade past the affected range:

- `files 0.16.10`