CVE-2026-29052
Stored XSS in HumHub Calendar Module Allows Admin Event Exploitation
Publication date: 2026-03-05
Last updated on: 2026-03-09
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| humhub | calendar | to 1.8.11 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-29052 is a Stored Cross-Site Scripting (XSS) vulnerability in the Event Types feature of the HumHub Calendar module. This vulnerability allows malicious scripts to be stored within event types and executed when users view events created by an administrative account.
It affects versions of the HumHub Calendar module prior to 1.8.11 and has been fixed in version 1.8.11 by improving the HTML encoding of event types.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute malicious scripts in the context of users viewing calendar events created by an administrative account.
Such script execution can lead to compromise of user security, including potential theft of session tokens, unauthorized actions performed on behalf of users, or other malicious activities.
Users are advised to upgrade to version 1.8.11 or later to mitigate this risk. If upgrading immediately is not possible, restricting permissions for creating and managing Event Types to highly trusted administrators is recommended.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability CVE-2026-29052, the primary recommended step is to upgrade the HumHub Calendar module to version 1.8.11 or later, where the issue has been patched.
If immediate upgrading is not possible, restrict the permissions for creating and managing Event Types to only highly trusted administrators to reduce the risk of exploitation.