CVE-2025-54790
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The Files module in versions 0.16.9 and below lacks logic to prevent exploitation of backend SQL queries without direct output, potentially allowing unauthorized data access. This is fixed in version 0.16.10.
Risk Assessment
The risk includes potential unauthorized access to data stored in spaces and user profiles, which could compromise confidentiality.
Recommendation
Update the Files module to version 0.16.10 or later, which includes the fix.
Other vulnerabilities in Files
See all- CVE-2025-59026Medium
Malicious content uploaded as a file can be used to execute script code when following attacker-controlled links. This can lead to unintended actions in the context of the user's account, including exfiltration of sensitive information.
- CVE-2025-30186Medium
Malicious content uploaded as a file can be used to execute script code when following attacker-controlled links. This can lead to unintended actions in the context of the user's account, including exfiltration of sensitive information.
- CVE-2025-65963Medium
The Files module for managing files in spaces and user profiles, prior to versions 0.16.11 and 0.17.2, has insufficient authorization checks allowing non-member users to create folders and upload/download files as a ZIP archive in public spaces. Private spaces are not affected.
- CVE-2025-54789Medium
The Files module in versions 0.16.9 and below lacks logic to prevent injection of arbitrary JavaScript in the File Move functionality, which can lead to Browser JS code execution in the context of the user's session. This is fixed in version 0.16.10.
Original NVD description (English source)
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, Files does not have logic to prevent the exploitation of backend SQL queries without direct output, potentially allowing unauthorized data access. This is fixed in version 0.16.10.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS