High · 7.4 CVE-2026-18526 EUVD-2026-62415

HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation

Published Aug 19, 2026 · Updated Aug 21, 2026 · Assigned by Fluid Attacks

Vendor: HumHub GmbH & Co. KG Product: humhub

Description

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow.

Affected products

Vendor	Product	Affected	Fixed
HumHub	HumHub	1.18.4	—

References

https://fluidattacks.com/advisories/greeicy third-party-advisory
https://github.com/humhub/humhub product
https://github.com/humhub/humhub/pull/8373 patch