CVE-2025-54789: Humhub Files Module XSS Vulnerability

CVE-2025-54789 Overview

CVE-2025-54789 is a stored cross-site scripting (XSS) vulnerability in the HumHub files (cfiles) module, which manages files inside spaces and user profiles. The File Move functionality fails to sanitize user-supplied input, allowing an authenticated attacker to inject arbitrary JavaScript. The injected script executes in the browser context of any user who interacts with the affected file view. Versions 0.16.9 and below are affected, and the issue is resolved in version 0.16.10. The weakness is classified as CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS).

Critical Impact
An authenticated attacker with write access to a space can execute arbitrary JavaScript in the session context of other HumHub users, enabling session theft, forced actions, and data exfiltration.

Affected Products

HumHub cfiles module versions 0.16.9 and earlier
HumHub deployments using the Files module for space and profile file management
Any HumHub instance where untrusted users can perform File Move operations

Discovery Timeline

2025-08-02 - CVE-2025-54789 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54789

Vulnerability Analysis

The HumHub cfiles module exposes a File Move operation that lets users relocate files and folders between directories inside a content container. The move handler accepts attacker-controlled string values, such as file or folder names, and renders them back into the DOM without adequate output encoding. Because the values pass through the response unescaped, an attacker can embed HTML event handlers or <script> payloads that execute when the browser parses the response.

The stored nature of the issue makes it more impactful than reflected XSS. The injected payload persists on the server as part of file metadata and fires each time a victim navigates to the affected view. Exploitation runs entirely in the victim's session, enabling actions such as CSRF token theft, forced content posting, and pivoting to other spaces the victim can access.

Root Cause

The root cause is missing HTML-context output encoding on file and folder identifiers processed by the move controller. HumHub's remediation in version 0.16.10 refactors the Files module ordering logic and controller imports, aligning the code path with the framework's safe rendering primitives so that user-supplied names no longer reach the DOM as raw HTML.

Attack Vector

Exploitation requires low-privilege authentication and user interaction. An attacker with permission to upload or rename files in a shared space stores a malicious payload as a file or folder attribute. When another authenticated user views or interacts with the moved item, their browser executes the payload in the HumHub origin.

php

// Security patch excerpts from HumHub cfiles v0.16.10
// File: Module.php - Refactor files sort ordering
     * @see FileSystemItemRow::ORDER_MAPPING
     */
    public $defaultSort = FileSystemItemRow::ORDER_TYPE_NAME;
-   public $defaultOrder = 'ASC';
+   public $defaultOrder = SORT_ASC;

    public $defaultPostedFilesSort = FileSystemItemRow::ORDER_TYPE_UPDATED_AT;
-   public $defaultPostedFilesOrder = 'ASC';
+   public $defaultPostedFilesOrder = SORT_ASC;

// File: controllers/BaseController.php - Import cleanup
 namespace humhub\modules\cfiles\controllers;

+use humhub\modules\content\components\ContentContainerController;
 use humhub\modules\content\models\Content;
+use humhub\modules\cfiles\models\Folder;
+use humhub\modules\cfiles\permissions\WriteAccess;
 use Yii;
-use yii\db\Expression;
 use yii\web\HttpException;

Source: HumHub cfiles commit f022bdd

Detection Methods for CVE-2025-54789

Indicators of Compromise

File or folder names containing HTML tags, JavaScript URI schemes, or event handler attributes such as onerror=, onload=, or <script>.
Unexpected outbound requests from user browsers to attacker-controlled hosts shortly after opening a shared HumHub space.
Session cookies or CSRF tokens appearing in web server access logs of external domains referenced from HumHub pages.

Detection Strategies

Query the HumHub database for file and folder titles matching regex patterns such as <\s*script, javascript:, or on\w+\s*= to surface stored payloads.
Inspect web server access logs for File Move endpoint requests (/cfiles/) containing encoded HTML metacharacters in parameter values.
Correlate authenticated session activity with anomalous DOM behavior reported by browser-based error telemetry.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script violations that would indicate active exploitation attempts.
Monitor administrative audit logs for unexpected file rename or move operations performed by low-privilege accounts.
Alert on newly created files or folders whose names exceed expected length or contain angle brackets and quote characters.

How to Mitigate CVE-2025-54789

Immediate Actions Required

Upgrade the HumHub cfiles module to version 0.16.10 or later on all HumHub instances.
Audit existing file and folder names across spaces and user profiles for stored XSS payloads and sanitize or remove any offending entries.
Review recent File Move actions performed by non-administrative accounts and validate they correspond to legitimate activity.

Patch Information

HumHub released the fix in the cfiles module version 0.16.10. Details are available in the GitHub Security Advisory GHSA-cw2v-c62w-5r43, the remediation commit f022bdd, and the v0.16.10 release notes. Administrators should apply the update through the HumHub marketplace or by upgrading the module package directly.

Workarounds

Restrict File Move and write permissions in the Files module to trusted users until the patch is deployed.
Deploy a strict Content Security Policy that disallows inline scripts (script-src 'self') to reduce the impact of any residual injection.
Temporarily disable the cfiles module in environments where untrusted users can create or rename files if immediate patching is not possible.

bash

# Verify installed cfiles module version and upgrade via composer
php yii module/list | grep cfiles
composer require humhub/cfiles:^0.16.10
php yii migrate/up --includeModuleMigrations=1