PT-2025-31709 · Files · Files

Mike Cole · Published 2025-08-01 · Updated 2025-09-12 · CVE-2025-54790

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Files versions 0.16.9 and below

Description Files, a module for managing files inside spaces and user profiles, lacks logic to prevent the exploitation of backend SQL queries without direct output. This could potentially allow unauthorized data access.

Recommendations Update to version 0.16.10 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-54790

GHSA-RFVQ-G9RM-PGQJ

Affected Products

Files

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54790.json · Exploit
• https://github.com/humhub/cfiles/security/advisories/GHSA-rfvq-g9rm-pgqj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54790 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54790 · Vendor Advisory
• https://github.com/humhub/cfiles/pull/252 · Note
• https://github.com/humhub/cfiles/releases/tag/v0.16.10 · Note
• https://t.me/CVEtracker/28996 · Telegram Post
• https://t.me/cveNotify/135296 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1951449772847505782 · Twitter Post
• https://t.me/cveNotify/130644 · Telegram Post
• https://twitter.com/offseq/status/1951432863942856999 · Twitter Post
• https://twitter.com/CVEnew/status/1951431042113372351 · Twitter Post