CVE-2026-29048

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-29048", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-03T17:50:11.243Z", "datePublished": "2026-03-06T06:59:42.084Z", "dateUpdated": "2026-03-09T19:56:13.803Z"}, "containers": {"cna": {"title": "HumHub: XSS in Button component", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/humhub/humhub/security/advisories/GHSA-qxjh-478x-23gm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/humhub/humhub/security/advisories/GHSA-qxjh-478x-23gm"}, {"name": "https://github.com/humhub/humhub/pull/8039", "tags": ["x_refsource_MISC"], "url": "https://github.com/humhub/humhub/pull/8039"}, {"name": "https://github.com/humhub/humhub/commit/bd06ab4c75f6c65295ee3e1ce3643437e8f9d10a", "tags": ["x_refsource_MISC"], "url": "https://github.com/humhub/humhub/commit/bd06ab4c75f6c65295ee3e1ce3643437e8f9d10a"}, {"name": "https://github.com/humhub/humhub/releases/tag/v1.18.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/humhub/humhub/releases/tag/v1.18.1"}], "affected": [{"vendor": "humhub", "product": "humhub", "versions": [{"version": "= 1.18.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T06:59:42.084Z"}, "descriptions": [{"lang": "en", "value": "HumHub is an Open Source Enterprise Social Network. In version 1.18.0, a cross-site scripting vulnerability was identified in the Button component of version 1.18.0. Due to inconsistent output encoding at several points within the software, malicious scripts could be injected and executed in the context of the user's browser. This issue has been patched in version 1.18.1."}], "source": {"advisory": "GHSA-qxjh-478x-23gm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T19:55:55.822924Z", "id": "CVE-2026-29048", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T19:56:13.803Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-29048", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T19:55:55.822924Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T19:56:05.907Z"}}], "cna": {"title": "HumHub: XSS in Button component", "source": {"advisory": "GHSA-qxjh-478x-23gm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "humhub", "product": "humhub", "versions": [{"status": "affected", "version": "= 1.18.0"}]}], "references": [{"url": "https://github.com/humhub/humhub/security/advisories/GHSA-qxjh-478x-23gm", "name": "https://github.com/humhub/humhub/security/advisories/GHSA-qxjh-478x-23gm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/humhub/humhub/pull/8039", "name": "https://github.com/humhub/humhub/pull/8039", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/humhub/humhub/commit/bd06ab4c75f6c65295ee3e1ce3643437e8f9d10a", "name": "https://github.com/humhub/humhub/commit/bd06ab4c75f6c65295ee3e1ce3643437e8f9d10a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/humhub/humhub/releases/tag/v1.18.1", "name": "https://github.com/humhub/humhub/releases/tag/v1.18.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "HumHub is an Open Source Enterprise Social Network. In version 1.18.0, a cross-site scripting vulnerability was identified in the Button component of version 1.18.0. Due to inconsistent output encoding at several points within the software, malicious scripts could be injected and executed in the context of the user's browser. This issue has been patched in version 1.18.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T06:59:42.084Z"}}}, "cveMetadata": {"cveId": "CVE-2026-29048", "state": "PUBLISHED", "dateUpdated": "2026-03-09T19:56:13.803Z", "dateReserved": "2026-03-03T17:50:11.243Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-06T06:59:42.084Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "humhub", "vendor": "humhub", "versions": [{"status": "affected", "version": "= 1.18.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:humhub:humhub:1.18.0:-:*:*:*:*:*:*", "matchCriteriaId": "074A6C7E-FBD1-4735-95CE-9C4972DB64B9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HumHub is an Open Source Enterprise Social Network. In version 1.18.0, a cross-site scripting vulnerability was identified in the Button component of version 1.18.0. Due to inconsistent output encoding at several points within the software, malicious scripts could be injected and executed in the context of the user's browser. This issue has been patched in version 1.18.1."}, {"lang": "es", "value": "HumHub es una Red Social Empresarial de C\u00f3digo Abierto. En la versi\u00f3n 1.18.0, se identific\u00f3 una vulnerabilidad de cross-site scripting en el componente Button de la versi\u00f3n 1.18.0. Debido a una codificaci\u00f3n de salida inconsistente en varios puntos dentro del software, se podr\u00edan inyectar y ejecutar scripts maliciosos en el contexto del navegador del usuario. Este problema ha sido parcheado en la versi\u00f3n 1.18.1."}], "id": "CVE-2026-29048", "lastModified": "2026-06-17T10:29:30.353", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29048", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T19:55:55.822924Z", "version": "2.0.3"}}]}, "published": "2026-03-06T07:16:01.920", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/humhub/humhub/commit/bd06ab4c75f6c65295ee3e1ce3643437e8f9d10a"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/humhub/humhub/pull/8039"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/humhub/humhub/releases/tag/v1.18.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/humhub/humhub/security/advisories/GHSA-qxjh-478x-23gm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.18.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "humhub", "source": "cna", "vendor": "humhub"}, "product": "humhub", "vendor": "humhub"}], "analysis": {"en": {"generated_at": "2026-04-17T12:22:55.114810+00:00", "value": {"mitigation_remediation": ["Upgrade HumHub to version 1.18.1 or later, where the output encoding bug is corrected.", "If an upgrade is not immediately possible, enforce strict output encoding or sanitization on any dynamic button labels to prevent script injection.", "Deploy application\u2011layer controls such as a web\u2011application firewall rule that blocks script payloads inserted into UI elements."], "summary": {"action": "Apply Patch", "impact": "Cross\u2011Site Scripting (XSS) in a user\u2011displayed Button component"}, "threat_synthesis": {"affected_systems": "The vulnerability affects HumHub 1.18.0, as identified by the CPE for that version. The issue is fixed in HumHub 1.18.1, which implements proper output encoding in the Button component. All owners of a 1.18.0 deployment are impacted.", "description_and_impact": "A software flaw in HumHub 1.18.0 allows an attacker to inject arbitrary, executable scripts through the Button component. Because the application performs inconsistent output encoding, malicious code can be rendered and run in the victim's browser, potentially stealing credentials or session data, defacing the interface, or performing actions on behalf of the user. The weakness corresponds to CWE\u201179, a typical client\u2011side injection flaw. The vulnerability is fixed in HumHub 1.18.1, which implements proper output encoding in the Button component.", "risk_and_exploitability": "The CVSS score of 6.9 indicates a moderate severity. EPSS is listed as <\u202f1\u202f%, implying a low probability of current exploitation. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. Attackers can create or modify a button in a page that renders untrusted content, so the likely attack vector is through a malicious link or content that exploits the unencoded output."}}}}, "created": "2026-03-09T10:08:25.787540+00:00", "updated": "2026-04-17T12:30:06.233110+00:00", "vendors": ["humhub", "humhub$PRODUCT$humhub"]}