HumHub 1.19.0 - Stored cross-site scripting in friendship confirmation
Summary
| CVE | CVE-2026-115541 |
|---|---|
| State | PUBLISHED |
| Assigner | Fluid Attacks |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-03 22:19:17 UTC |
| Updated | 2026-11-03 22:19:17 UTC |
| Description | HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for that profile, HumHub places the decoded display name into a modal through jQuery html(), causing attacker-controlled markup to execute in the victim's HumHub origin. |
Risk And Classification
Primary CVSS: v4.0 7.2 HIGH from [email protected]
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-79 | CWE-79 CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 7.2 | HIGH | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 7.2 | HIGH | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | HumHub | HumHub Community Edition | affected 1.18.7 semver | Windows, MacOS, Linux |
| CNA | HumHub | HumHub Community Edition | affected 1.19.0 1.19.1 semver | Windows, MacOS, Linux |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/humhub/humhub/releases/tag/v1.18.7 | [email protected] | github.com | |
| github.com/humhub/humhub/pull/8625 | [email protected] | github.com | |
| github.com/humhub/humhub/pull/8624 | [email protected] | github.com | |
| fluidattacks.com/advisories/toujours | [email protected] | fluidattacks.com | |
| github.com/humhub/humhub | [email protected] | github.com | |
| github.com/humhub/humhub/releases/tag/v1.19.3 | [email protected] | github.com | |
| github.com/humhub/humhub/security/advisories/GHSA-ph8x-wg86-qp2m | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Miguel Gómez (en)
CNA: Fluid Attacks' AI SAST Scanner (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-10-15T00:59:00.000Z | Vulnerability discovered |
| CNA | 2026-10-22T22:46:00.000Z | Vendor contacted |
| CNA | 2026-10-22T22:47:00.000Z | Vendor replied |
| CNA | 2026-10-26T10:35:00.000Z | Vulnerability patched |
| CNA | 2026-11-03T21:57:00.000Z | Public disclosure |
Solutions
CNA: Upgrade the current line to HumHub 1.19.2 or later (1.19.3 is the current release), or the 1.18 maintenance line to 1.18.7 or later. The vendor fixed the issue in 1.19.1 and 1.18.7; 1.19.1 was not separately released.
Workarounds
CNA: If an immediate upgrade is not possible, disable the friendship feature or restrict profile editing to trusted users. Review existing profile names for markup, but treat cleanup as a temporary mitigation rather than a fix.