CVE-2025-64442: HumHub is vulnerable to XSS through its Meta Search component

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-07 · updated 2026-06-17
Weakness: CWE-79

Description

HumHub is an Open Source Enterprise Social Network. Versions below 1.17.4 have a XSS vulnerability in the Meta-Search feature which allows malicious input to be executed in search previews. This issue is fixed in version 1.17.4.

Affected products

humhub: before 1.17.4 — fixed in 1.17.4

How to fix

Upgrade to a fixed version: humhub 1.17.4. Check the vendor advisory for mitigations.

References

https://github.com/humhub/humhub/pull/7814
https://github.com/humhub/humhub/releases/tag/v1.17.4
https://github.com/humhub/humhub/security/advisories/GHSA-2hgp-33j2-93cc

Get alerted when CVE-2025-64442 or the next vulnerability affects your stack