CVE-2025-54790

critical · 9.2

Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, Files does not have logic to prevent the exploitation of backend SQL queries without direct output, potentially allowing unauthorized data access. This is fixed in version 0.16.10.

9.2

CVSS

0.3%

EPSS (exploit prob.)

24th

EPSS percentile

2025-08-02

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
humhub	files	< 0.16.10

Check a specific version with /api/v1/cve/match.

References

https://github.com/humhub/cfiles/pull/252
https://github.com/humhub/cfiles/releases/tag/v0.16.10
https://github.com/humhub/cfiles/security/advisories/GHSA-rfvq-g9rm-pgqj

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-54790