CVE-2019-9093

Name of the Vulnerable Software and Affected Versions Humhub version 1.3.10 Community Edition

Description A Reflected Cross Site Scripting (XSS) issue was found in the file upload functionality. Specifically, user-supplied input containing a JavaScript payload in the filename parameter is echoed back, resulting in reflected XSS. This occurs in the /file/file/upload endpoint.

Recommendations For Humhub version 1.3.10 Community Edition, as a temporary workaround, consider validating and sanitizing the filename parameter to prevent the injection of malicious JavaScript payloads. Restrict access to the /file/file/upload endpoint until a proper fix is applied.