CVE-2025-64442: HumHub XSS Vulnerability in Meta-Search

CVE-2025-64442 Overview

CVE-2025-64442 is a stored Cross-Site Scripting (XSS) vulnerability in HumHub, an open source enterprise social network platform. The flaw resides in the Meta-Search feature, where malicious input is rendered without proper sanitization inside search previews. Attackers can inject JavaScript payloads that execute in the browser context of any user who views the affected search results. All HumHub versions below 1.17.4 are affected, and the issue is tracked as [CWE-79]. The vendor addressed the issue in release 1.17.4.

Critical Impact
Attackers can execute arbitrary JavaScript in the browsers of HumHub users through crafted Meta-Search input, enabling session theft, credential harvesting, and unauthorized actions on behalf of victims.

Affected Products

HumHub versions prior to 1.17.4
HumHub Meta-Search feature component
Self-hosted HumHub Enterprise Social Network deployments

Discovery Timeline

2025-11-07 - CVE-2025-64442 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64442

Vulnerability Analysis

The vulnerability is a client-side script injection flaw in the HumHub Meta-Search feature. Search preview output includes user-controlled content that is not correctly encoded before being rendered in the browser. When a user submits a query or supplies searchable data containing HTML or JavaScript, the preview renders the payload as executable markup. Any authenticated or unauthenticated user who triggers a search preview may execute the injected script under the origin of the HumHub site. Because HumHub is a social platform, the injected code can access authenticated session state, perform actions on behalf of the victim, and pivot to other users through social features.

Root Cause

The root cause is missing or insufficient output encoding in the Meta-Search preview rendering path. HumHub failed to neutralize HTML control characters in strings that flow from search input into the preview template. The upstream fix in pull request humhub/humhub#7814 applies proper escaping to the affected preview output, breaking the injection sink.

Attack Vector

Exploitation requires network access to a vulnerable HumHub instance and user interaction, since a victim must view the tainted search preview. An attacker seeds the Meta-Search surface with crafted content containing script markup. When any user, including administrators, opens the search preview, the injected script executes with the victim's browser privileges. The vulnerability does not require attacker authentication in scenarios where anonymous content contributes to search indexes.

Detailed technical mechanics are documented in the GitHub Security Advisory GHSA-2hgp-33j2-93cc and the upstream patch pull request.

Detection Methods for CVE-2025-64442

Indicators of Compromise

Search query parameters or indexed content containing <script>, onerror=, onload=, or javascript: sequences reaching the Meta-Search endpoint.
Unexpected outbound requests from user browsers to attacker-controlled domains following interaction with search previews.
HumHub audit logs showing content creation followed by anomalous session activity for viewers of that content.

Detection Strategies

Inspect HTTP access logs for Meta-Search requests carrying HTML-encoded or raw script payloads in query strings and response bodies.
Deploy a Content Security Policy (CSP) in report-only mode and monitor violation reports for inline script executions on search pages.
Review stored HumHub content for HTML tags in fields that should contain plain text, focusing on records created before upgrading to 1.17.4.

Monitoring Recommendations

Alert on repeated 200 responses to Meta-Search endpoints that reflect user-supplied HTML markup.
Correlate account privilege changes and password resets with prior views of search previews from the same session.
Track HumHub version metadata across managed instances to identify hosts still running versions below 1.17.4.

How to Mitigate CVE-2025-64442

Immediate Actions Required

Upgrade all HumHub instances to version 1.17.4 or later using the official v1.17.4 release.
Audit user-generated content and search-indexed fields for embedded HTML or script content and sanitize or remove offending entries.
Force session invalidation for accounts that may have viewed malicious search previews before patching.

Patch Information

HumHub released version 1.17.4 containing the fix delivered in pull request humhub/humhub#7814. The patch applies proper output encoding to the Meta-Search preview rendering path. Administrators should follow the standard HumHub upgrade procedure and verify the running version after deployment.

Workarounds

Restrict access to the Meta-Search feature through reverse proxy rules until the upgrade is completed.
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources to blunt exploitation attempts.
Limit content creation privileges to trusted users temporarily to reduce the attack surface for stored payloads.

bash

# Verify the installed HumHub version after upgrade
php /path/to/humhub/protected/yii version

# Example nginx CSP header to mitigate XSS execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;