CVE-2026-115541 in Community Edition
Summary
by MITRE • 11/03/2026
HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for that profile, HumHub places the decoded display name into a modal through jQuery html(), causing attacker-controlled markup to execute in the victim's HumHub origin.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
HumHub Community Edition version 1.19.0 is susceptible to a stored cross-site scripting vulnerability within its friendship confirmation dialog mechanism, representing a significant security flaw for community-driven platforms that rely on user interaction and profile management. This vulnerability stems from the application's failure to properly sanitize or encode user-supplied input when rendering it in subsequent HTTP responses, specifically targeting the display of first and last names associated with user profiles. The root cause lies in how the backend processes and stores these fields without applying adequate output encoding before they are injected into the HTML structure via client-side JavaScript methods that do not inherently prevent script execution.
The technical flaw allows an authenticated low-privileged member to inject malicious HTML or JavaScript payloads by saving them directly within their first name or last name fields during profile registration or modification. Because this data is stored in the database and later retrieved for display, it constitutes a stored XSS attack vector rather than a reflected one. When another authenticated user navigates to view the attacker's profile and interacts with the Friends section, HumHub utilizes jQuery's html() method to populate a modal dialog with the decoded display name. The use of this specific DOM manipulation technique bypasses standard browser protections against script injection because it interprets the inserted string as HTML content rather than plain text, thereby executing any embedded scripts within the context of the victim's session and origin.
The operational impact of this vulnerability is severe due to its stored nature and the requirement for a secondary user interaction to trigger execution. Once triggered, an attacker can execute arbitrary JavaScript code in the security context of the HumHub application on behalf of the victim. This enables potential account takeover through session hijacking by stealing authentication cookies or tokens, unauthorized actions such as posting content, changing settings, or adding friends without consent, and phishing attacks where malicious forms are injected to harvest credentials from unsuspecting users. Since the payload is stored server-side, every user who views the compromised profile has a high probability of being affected if they interact with the friendship interface, leading to widespread compromise within the community platform.
From an industry standard perspective, this vulnerability aligns closely with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and specifically falls under the subcategory of Stored XSS where malicious scripts are permanently stored on target servers. In terms of threat modeling frameworks like MITRE ATT&CK, this behavior maps to techniques involving Client-Side Injection such as T1059 which covers execution through scripting languages, and potentially T1204 for User Execution if social engineering is used to lure victims into viewing specific profiles. The vulnerability highlights the critical importance of implementing strict output encoding on all dynamic content before it reaches the client-side DOM, particularly when using JavaScript libraries that manipulate HTML structures directly.
Mitigation strategies should focus primarily on enforcing robust input validation and output encoding at both the application layer and database interaction layers. Developers must ensure that special characters in user-supplied fields like names are encoded to their corresponding HTML entities before being rendered in views or passed to client-side scripts. Additionally, replacing direct DOM manipulation via jQuery html() with safer alternatives such as textContent or using frameworks that automatically escape content can significantly reduce the risk of XSS. Implementing a Content Security Policy (CSP) header with strict directives regarding script sources and inline script execution provides an additional layer of defense by restricting where scripts can run and preventing unauthorized code injection even if other controls fail. Regular security audits and static application testing should be integrated into the development lifecycle to detect such encoding failures early.