HumHub CFiles Module Insufficient Authorization Vulnerability Allowing Unauthorized File Management in Public Spaces

A vulnerability exists in the HumHub CFiles module, specifically in versions prior to 0.16.11 and 0.17.2. The issue arises from inadequate authorization checks, which permit non-member users to create folders and upload or download files as a ZIP archive in public spaces. Private spaces are not impacted.

Impact

The vulnerability could lead to unauthorized file management actions, such as creating folders and manipulating files, in public spaces.

Remediation

Users can update to CFiles version 0.16.11 or 0.17.2 to address this vulnerability. If an immediate update is not possible, the ZIP import and download functionality can be disabled as a temporary workaround.