HumHub Calendar Module Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Calendar module of HumHub, affecting versions prior to 1.8.11. This issue allows an administrative user to inject malicious scripts into Event Types, which are then executed when other users view those events.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the event.

Remediation

Users are advised to upgrade to HumHub Calendar version 1.8.11 or later. Those unable to upgrade should limit permissions for creating and managing Event Types to trusted administrators only.