PT-2026-23407 · Humhub · Humhub Calendar

Lassi · Published 2026-03-05 · Updated 2026-03-09 · CVE-2026-29052

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions HumHub Calendar module versions prior to 1.8.11

Description The Calendar module for HumHub allows users to create and manage events. A stored cross-site scripting (XSS) issue exists in the Event Types functionality of the Calendar module for versions prior to 1.8.11. This impacts users viewing events created by an administrative account. The issue allows an attacker to inject malicious scripts into the application through the Event Types feature. The vulnerability is triggered when a user views events created by an administrative account.

Recommendations Update to HumHub Calendar module version 1.8.11 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-29052

GHSA-GQJ3-PMP2-MRX8

Affected Products

Humhub Calendar

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29052.json · Exploit
• https://github.com/humhub/calendar/security/advisories/GHSA-gqj3-pmp2-mrx8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29052 · Security Note
• https://osv.dev/vulnerability/CVE-2026-29052 · Vendor Advisory
• https://github.com/humhub/calendar/releases/tag/v1.8.11 · Note
• https://twitter.com/CVEnew/status/2030755407048696241 · Twitter Post
• https://t.me/cveNotify/154854 · Telegram Post
• https://t.me/CVEtracker/46414 · Telegram Post