CVE-2025-65963: Files Module Authorization Bypass Vulnerability

CVE-2025-65963 Overview

CVE-2025-65963 is a broken access control vulnerability in the HumHub cfiles module, which manages files inside spaces and user profiles. Insufficient authorization checks allow non-member users to create new folders and upload or download files as a ZIP archive in public spaces. Private spaces are not affected by this flaw. The issue is tracked as CWE-284: Improper Access Control and has been patched in cfiles versions 0.16.11 and 0.17.2.

Critical Impact

Authenticated users who are not members of a public space can create folders and exfiltrate or inject file content through the ZIP download and upload endpoints, breaking the space-membership trust boundary.

Affected Products

• HumHub cfiles module versions prior to 0.16.11 (0.16.x branch)
• HumHub cfiles module versions prior to 0.17.2 (0.17.x branch)
• HumHub deployments exposing public spaces with the cfiles module enabled

Discovery Timeline

• 2025-11-26 - CVE-2025-65963 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-65963

Vulnerability Analysis

The cfiles module provides folder and file management inside HumHub spaces. In vulnerable versions, several controller actions responsible for folder creation, file upload, and ZIP download do not verify that the requesting user is a member of the target space. When the space is marked public, HumHub's base access logic grants read visibility, but the cfiles module extends writable operations without re-checking per-object permissions.

As a result, any authenticated HumHub user can interact with files in a public space as if they were a member. The ZIP download path additionally aggregates child files without validating each item against the caller's view permissions, which can expose files that should remain restricted.

Root Cause

The root cause is missing authorization enforcement in the file aggregation and folder management code paths. Specifically, the ZIP generation routine in libs/ZIPCreator.php dereferences a file reference without calling the per-item canView() check before adding it to the archive. The patch introduces that check so inaccessible items are skipped during archive construction.

Attack Vector

Exploitation requires network access to the HumHub instance and a low-privileged authenticated account. The attacker browses to a public space, then issues requests to the cfiles folder-create, upload, or ZIP-download endpoints. Because membership is never validated, the module processes the request and returns or stores content on the attacker's behalf.

// Patch excerpt from libs/ZIPCreator.php
// Adds a per-file canView() check before including the file in the archive
            $file = $file->baseFile;
        }

-        if (!$file) {
+        if (!$file || !$file->canView()) {
            return;
        }

Source: GitHub commit 75698f8e8f360cea470f0e9f264015b697ab4c09

The accompanying module.json change bumps the module version so administrators can confirm the fix is installed:

     "organisation",
     "sharing"
 ],
-    "version": "0.16.10",
+    "version": "0.16.11",
 "humhub": {
     "minVersion": "1.14"
 },

Source: GitHub commit 75698f8e8f360cea470f0e9f264015b697ab4c09

Detection Methods for CVE-2025-65963

Indicators of Compromise

• Folder creation events in public spaces performed by user accounts that are not listed as space members.
• ZIP download requests to cfiles endpoints originating from accounts with no membership relation to the target space.
• Unexpected uploads to public space file directories from accounts with low engagement history.

Detection Strategies

• Compare cfiles controller access logs against the space membership table to flag non-member write operations.
• Alert on bursts of ZIP download requests from a single account across multiple public spaces within a short window.
• Review cfiles module version in module.json across all HumHub instances and flag anything below 0.16.11 or 0.17.2.

Monitoring Recommendations

• Enable web server access logging for all /cfiles/ routes, including query parameters identifying the target space and folder.
• Forward HumHub application logs to a centralized log platform and build a dashboard for folder-create and ZIP-download actions grouped by space visibility.
• Monitor for anomalous outbound bandwidth from the HumHub host that may correspond to bulk ZIP downloads.

How to Mitigate CVE-2025-65963

Immediate Actions Required

• Upgrade the HumHub cfiles module to version 0.16.11 or 0.17.2 depending on the branch in use.
• Inventory public spaces and audit their file contents for unauthorized folders or uploads created before patching.
• Rotate or remove any sensitive attachments that were stored in public spaces during the exposure window.

Patch Information

The fix is published in HumHub cfiles releases 0.16.11 and 0.17.2. The patch, documented in GitHub Security Advisory GHSA-rv2x-7qwp-2hf4, adds a canView() authorization check in libs/ZIPCreator.php and tightens access control on folder and file management actions. Administrators should verify the installed module version via module.json after deployment.

Workarounds

• Convert affected public spaces to private spaces until the module is patched, since private spaces are not affected.
• Temporarily disable the cfiles module on instances that rely heavily on public spaces and cannot be upgraded immediately.
• Restrict new account registration or require administrator approval to limit the pool of authenticated users who could abuse the flaw.

# Upgrade the cfiles module using HumHub's module management CLI
php yii module/update cfiles

# Verify the installed version is patched
grep '"version"' protected/modules/cfiles/module.json