CVE-2025-54790 Files: Potential for SQL Injection through File Browse and List Operations
An attacker can exploit SQL injection in file browse and list operations to access unauthorized data in the HumHub Files plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-54790?
CVE-2025-54790 is a critical SQL injection vulnerability in humhub cfiles, published on 1 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, Files does not have logic to prevent the exploitation of backend SQL queries without direct output, potentially allowing unauthorized data access. This is fixed in version 0.16.10.
Weakness: CWE-89
Which versions are affected by CVE-2025-54790?
It affects 1 product.
Products include Humhub Files.
How do I fix CVE-2025-54790?
No fix has been published for CVE-2025-54790 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-54790 being exploited?
There is no known exploitation of CVE-2025-54790 in the wild and no public exploit code.
Other vulnerabilities in humhub cfiles
Sources
Also known as GHSA-rfvq-g9rm-pgqj.