CVE-2026-18430

HighCVSS 7.2

Published: 19/08/2026(UTC)Updated: 19/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Summary

HumHub 1.18.4 contains a stored cross-site scripting (XSS) vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason.

Risk Assessment

The risk includes execution of malicious scripts in the victim's browser, potentially leading to session theft, account takeover, and data confidentiality breach.

Recommendation

It is recommended to upgrade HumHub to a version that includes a fix for the XSS vulnerability and to validate and sanitize input data.

Original NVD description (English source)

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason.