CVE-2025-54789
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Files module in versions 0.16.9 and below lacks logic to prevent injection of arbitrary JavaScript in the File Move functionality, which can lead to Browser JS code execution in the context of the user's session. This is fixed in version 0.16.10.
Risk Assessment
The risk includes the possibility of executing malicious scripts in the victim's browser, which could lead to session theft or other XSS attacks.
Recommendation
Update the Files module to version 0.16.10 or later, which includes the fix.
Other vulnerabilities in Files
See all- CVE-2025-59026Medium
Malicious content uploaded as a file can be used to execute script code when following attacker-controlled links. This can lead to unintended actions in the context of the user's account, including exfiltration of sensitive information.
- CVE-2025-30186Medium
Malicious content uploaded as a file can be used to execute script code when following attacker-controlled links. This can lead to unintended actions in the context of the user's account, including exfiltration of sensitive information.
- CVE-2025-65963Medium
The Files module for managing files in spaces and user profiles, prior to versions 0.16.11 and 0.17.2, has insufficient authorization checks allowing non-member users to create folders and upload/download files as a ZIP archive in public spaces. Private spaces are not affected.
- CVE-2025-54790Medium
The Files module in versions 0.16.9 and below lacks logic to prevent exploitation of backend SQL queries without direct output, potentially allowing unauthorized data access. This is fixed in version 0.16.10.
Original NVD description (English source)
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed in version 0.16.10.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS