CVE-2025-54789: Files is Vulnerable to Reflected Self-XSS through its File Move Functionality
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed in version 0.16.10.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54789?
CVE-2025-54789 is considered a critical vulnerability due to the potential for arbitrary JavaScript code execution.
How do I fix CVE-2025-54789?
To mitigate CVE-2025-54789, upgrade to version 0.16.10 or later of the Files module.
What causes CVE-2025-54789?
CVE-2025-54789 is caused by a lack of input validation in the File Move functionality that allows injection of arbitrary JavaScript.
Who is affected by CVE-2025-54789?
Users of the Files module version 0.16.9 and below are affected by CVE-2025-54789.
What are the consequences of CVE-2025-54789?
The main consequence of CVE-2025-54789 is that attackers can execute malicious JavaScript in the context of the user's session.