CVE-2025-54789

The CVE-2025-54789 entry relates to the Files module, specifically the File Move functionality. Versions ≤ 0.16.9 allow injection of arbitrary JavaScript, enabling Browser JavaScript execution in the user’s session. This is the underlying issue described across multiple sources (NVD, Red Hat advi...

CVE-2025-54790

CVE-2025-54790 affects the Files module (HumHub cfiles) in versions 0.16.9 and earlier. The root cause is missing input handling to block exploitation of backend SQL queries, potentially enabling unauthorized data access to files in spaces and user profiles. The issue is fixed in version 0.16.10....