CVE-2025-54790
Files: Potential for SQL Injection through File Browse and List Operations
Vexday Risk Score
28Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 9.2EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
01 Aug 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, Files does not have logic to prevent the exploitation of backend SQL queries without direct output, potentially allowing unauthorized data access. This is fixed in version 0.16.10.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
humhub · cfilesWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →