Executive brief
The Calendar module for HumHub is used to create and manage events with attendee invitations across teams and organizations. A stored cross-site scripting (XSS) vulnerability in event type creation allows administrators to inject malicious code that executes when other users view those events, potentially compromising account credentials, session tokens, or sensitive information.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Event Types feature of the HumHub Calendar module prior to version 1.8.11. The vulnerability stems from improper HTML encoding of event type data when rendered in the user interface. An attacker with administrative privileges can inject malicious JavaScript into event type fields, which is then stored and executed in the browsers of all users viewing those events. The patch in version 1.8.11 adds HTML encoding to event type assets. No special authentication or network preconditions beyond normal HumHub access are required—the attacker must have administrative privileges to create event types, but the payload executes for any user viewing the events.
Affected products
- HumHub Calendar module < 1.8.11
Timeline
- 2026-03-02: disclosed
- 2026-03-02: patched: version 1.8.11 released
- 2026-03-05: advisory