by Kastro
Paper/Archive/CVE-2025-54790

CVE-2025-54790

humhub cfiles — Files: Potential for SQL Injection through File Browse and List Operations

EPSS 0.3%CVSS 9.2
critical.is priorityof 100
33
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 27.6.276 × 205.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, Files does not have logic to prevent the exploitation of backend SQL queries without direct output, potentially allowing unauthorized data access. This is fixed in version 0.16.10.

Affected

ProductAffectedFixed inSource
cfiles< 0.16.10–CNA

Scores by source

GitHub_M (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/humhub/cfiles/security/advisories/GHSA-rfvq-g9rm-pgqjrefgithub.com/humhub/cfiles/pull/252refgithub.com/humhub/cfiles/releases/tag/v0.16.10