Humhub has 4 CVEs on record between 2025 and 2026. 1 was published in the last 90 days. The median CVSS is 6.3 (medium). Most affected products: files (2), Humhub (1), calendar (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.3
- Publish → KEV
- —
- Last 90 days
- 1 prev 0
Worst active — by depth score
CVE-2026-93769High· 7.2HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a …40CVE-2025-54790Medium· 6.5Files is a module for managing files inside spaces and user profiles36CVE-2026-29052Medium· 6.1The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities34CVE-2025-54789Medium· 6.1Files is a module for managing files inside spaces and user profiles34
Humhub vulnerabilities
CVEs affecting Humhub, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-93769High· 7.2HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a …
HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a …
CVE-2026-29052Medium· 6.1The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities
The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities. Prior to version 1.8.11, a Stored Cross-Site Scripting (XSS) vulnerability …
CVE-2025-54790Medium· 6.5Files is a module for managing files inside spaces and user profiles
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, Files does not have logic to prevent the exploitation of backend SQL queries without direct output, potentially allowing unauthorized dat…
CVE-2025-54789Medium· 6.1Files is a module for managing files inside spaces and user profiles
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code exe…