CVE-2026-29052

HumHub Calendar Module: Stored XSS in Event Types

Medium6.9EPSS 0.19%

Published: 5 Mar 2026
Updated: 5 Mar 2026
Reserved: 3 Mar 2026
Assigned by: GitHub_M

Description

The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities. Prior to version 1.8.11, a Stored Cross-Site Scripting (XSS) vulnerability in the Event Types of the HumHub Calendar module impacts users viewing events created by an administrative account. This issue has been patched in version 1.8.11.

Scores

CVSS scores of CVE-2026-29052, by who scored it
Scored by	CVSS	Score	Vector
GitHub_MCNA (assigner)	4.0	Medium6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
NVDNVD · Analyzed	4.0	Medium6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.19% · top 92% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.

Weakness

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

humhub · calendar
- affected < 1.8.11

References (2)

https://github.com/humhub/calendar/security/advisories/GHSA-gqj3-pmp2-mrx8 (opens in a new tab)x_refsource_CONFIRM
https://github.com/humhub/calendar/releases/tag/v1.8.11 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-29052](https://trackcve.app/badge/CVE-2026-29052.svg)](https://trackcve.app/cve/CVE-2026-29052)

Record last updated 5 Mar 2026, 15:30 UTC.