CVE-2026-115541
HumHub 1.19.0 - Stored cross-site scripting in friendship confirmation
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for that profile, HumHub places the decoded display name into a modal through jQuery html(), causing attacker-controlled markup to execute in the victim's HumHub origin.
| CWE | CWE-79 |
| Vendor | humhub |
| Product | humhub community edition |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for humhub humhub community edition
Be the first to know when new unknown vulnerabilities affecting humhub humhub community edition are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
HumHub / HumHub Community Edition
0 < 1.18.7 1.19.0 < 1.19.1
References
fluidattacks.com: https://fluidattacks.com/advisories/toujours github.com: https://github.com/humhub/humhub github.com: https://github.com/humhub/humhub/security/advisories/GHSA-ph8x-wg86-qp2m github.com: https://github.com/humhub/humhub/pull/8624 github.com: https://github.com/humhub/humhub/pull/8625 github.com: https://github.com/humhub/humhub/releases/tag/v1.19.3 github.com: https://github.com/humhub/humhub/releases/tag/v1.18.7
Credits
Miguel Gómez Fluid Attacks' AI SAST Scanner