A software flaw in HumHub 1.18.0 allows an attacker to inject arbitrary, executable scripts through the Button component. Because the application performs inconsistent output encoding, malicious code can be rendered and run in the victim's browser, potentially stealing credentials or session data, defacing the interface, or performing actions on behalf of the user. The weakness corresponds to CWE‑79, a typical client‑side injection flaw. The vulnerability is fixed in HumHub 1.18.1, which implements proper output encoding in the Button component.

The vulnerability affects HumHub 1.18.0, as identified by the CPE for that version. The issue is fixed in HumHub 1.18.1, which implements proper output encoding in the Button component. All owners of a 1.18.0 deployment are impacted.

The CVSS score of 6.9 indicates a moderate severity. EPSS is listed as < 1 %, implying a low probability of current exploitation. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. Attackers can create or modify a button in a page that renders untrusted content, so the likely attack vector is through a malicious link or content that exploits the unencoded output.