External risk intelligence

HumHub Files SQL Injection Vulnerability Allows Unauthorized Data Access

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2025-54790

The vulnerability affects a file management module within HumHub, a social networking and collaboration platform. As a web-based application designed for user-generated content and collaboration, such platforms are typically deployed as public-facing or internet-accessible web services to facilitate user access and interaction.

SQL Injection

Humhub Files

before 0.16.10

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the Files module for HumHub, which is used for managing files within spaces and user profiles. This flaw could potentially allow unauthorized access to sensitive data. The issue has been addressed in a subsequent release of the module.

Unauthorized data access is possible.
Confirm if this file module is in use.
Prioritize confirming relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by targeting the file management module, which lacks proper security checks for backend SQL queries. This exposure allows unauthorized access to data without direct output, potentially leading to sensitive information disclosure.

No authentication or privileges needed.
Manipulates backend SQL queries.
Unauthorized data access and disclosure.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow unauthorized access to data by exploiting backend SQL queries within the Files module. This could affect system data and user data managed by the module.

System and user data.
Exploiting backend SQL queries.
Unauthorized data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Files module likely impacts application owners and platform teams responsible for the HumHub deployment. The first practical step is to inventory all instances of the Files module, determine their network exposure, and identify their specific owners within the organization. Subsequent remediation planning should be risk-based, prioritizing critical or externally facing instances.

Identify accountable application owners.
Verify affected asset exposure.
Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the HumHub Files module?

The Files module is a specific component within the HumHub social networking and collaboration platform. It provides the necessary infrastructure for users to upload, organize, and manage documents and media within their individual profiles and shared digital workspaces.

What does CWE-89 mean for CVE-2025-54790?

CWE-89 refers to Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. In this case, the module fails to properly sanitize inputs, allowing an attacker to manipulate backend database queries to access information they are not authorized to view.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specifically crafted requests to the Files module that exploit backend database logic. Crucially, the vulnerability does not require the attacker to have an existing user account, administrative privileges, or specific user interaction to attempt this unauthorized data access.

Why should I care about this if my site is internal?

Halo Surface Signal indicates that because HumHub is designed for collaboration, it is frequently deployed as a public-facing web service. Even if your instance seems internal, any path that allows network requests to the Files module from outside the trusted perimeter increases the risk that this flaw could be reached.

What is the first step to address this CVE?

You should immediately inventory your HumHub installations to confirm if the affected Files module is present. Check your current version against 0.16.10, which contains the security fix. If you are running version 0.16.9 or lower, prioritize updating the module to the latest release to close the security gap.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.