CVE-2026-115541— HumHub 1.19.0 - Stored cross-site scripting in friendship confirmation

Quick assessment

Affected

HumHub HumHub Community Edition

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

HumHub 社区版 1.19.0 在好友确认对话框中存在存储型跨站脚本（Stored XSS）漏洞。一名已认证的低权限用户可在其“名”和“姓”字段中保存 HTML 代码。当另一名已认证用户点击该用户资料上的“添加好友”按钮时，HumHub 会通过 jQuery 的方法将解码后的显示名称插入到模态对话框中，导致攻击者控制的标记在受害者的 HumHub 站点上下文中执行。

CVSS 7.2 · High Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

HumHub 1.19.0 - Stored cross-site scripting in friendship confirmation

Source: CVE Program / CVE List V5

Vulnerability Description

HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for that profile, HumHub places the decoded display name into a modal through jQuery html(), causing attacker-controlled markup to execute in the victim's HumHub origin.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
HumHub	HumHub Community Edition	0 ~ 1.18.7	-

II. Public POCs for CVE-2026-115541

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-115541

请登录查看更多情报信息。

Vendor Pages for CVE-2026-115541 (1)

🔗 GitHub - humhub/humhub: HumHub is an Open Source Enterprise Social Network. Easy to install, intuitive to use and extendable with countless freely available modules. · GitHub product

Other References for CVE-2026-115541 (6)

https://github.com/humhub/humhub/releases/tag/v1.19.3 release-notes
https://fluidattacks.com/advisories/toujours third-party-advisory
https://github.com/humhub/humhub/security/advisories/GHSA-ph8x-wg86-qp2m vendor-advisory
https://github.com/humhub/humhub/releases/tag/v1.18.7 release-notes
https://github.com/humhub/humhub/pull/8625 patch
https://github.com/humhub/humhub/pull/8624 patch

https://www.cve.org/CVERecord?id=CVE-2026-115541

IV. Related Vulnerabilities

Same vendor: HumHub

Same weakness: CWE-79