Live › vulnerability › CVE-2026-115541
HumHub Community Edition 1.19.0 lets a logged-in member save HTML in their first and last name. When another logged-in user clicks Friends on that profile, the name is inserted as markup into the confirmation dialog, so the script runs in the victim's HumHub session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:15 UTC. All times on this page are UTC.
Self-hosted HumHub installations below 1.18.7, or version 1.19.0, with the friendship system enabled and display names built from first and last name. Any registered user can store markup in their own name; it runs in the session of anyone who clicks Friends on their profile or People entry, including administrators. Installations with friendships disabled or username display format can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| humhub | packagist | < 1.18.7, >= 1.19.0, < 1.19.1 | 1.18.7, 1.19.1 |
1.18.7 (1.18 line) or 1.19.1 or later (1.19 line)Enable user friendship system under Administration > Settings > General, or set the display name format to username under Administration > Settings > AppearanceEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for that profile, HumHub places the decoded display name into a modal through jQuery html(), causing attacker-controlled markup to execute in the victim's HumHub origin.
This page as .md · .json · in your agent: get_signal("CVE-2026-115541")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.