What’s Vulnerable › Vulnerabilities

CVE-2025-54790: Files: Potential for SQL Injection through File Browse and List Operations

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-02 · updated 2026-09-02
• Weakness: CWE-89

Description

Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, Files does not have logic to prevent the exploitation of backend SQL queries without direct output, potentially allowing unauthorized data access. This is fixed in version 0.16.10.

Affected products

• humhub cfiles: before 0.16.10 — fixed in 0.16.10

How to fix

Upgrade to a fixed version: humhub cfiles 0.16.10. Check the vendor advisory for mitigations.

References

• https://github.com/humhub/cfiles/pull/252
• https://github.com/humhub/cfiles/releases/tag/v0.16.10
• https://github.com/humhub/cfiles/security/advisories/GHSA-rfvq-g9rm-pgqj

Get alerted when CVE-2025-54790 or the next vulnerability affects your stack