CVE-2026-29052
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedThe Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities. Prior to version 1.8.11, a Stored Cross-Site Scripting (XSS) vulnerability in the Event Types of the HumHub Calendar module impacts users viewing events created by an administrative account. This issue has been patched in version 1.8.11.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceA Stored Cross-Site Scripting (XSS) vulnerability exists in the Calendar module for HumHub's Event Types feature. An administrative account can inject malicious JavaScript payloads into event type configurations, which then execute when other users view those events. This is a stored XSS (not reflected), meaning the malicious script persists on the server.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 1.8.11CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify HumHub Calendar module versionAccess the HumHub administration panel, navigate to Modules > Installed Modules, and locate the Calendar module to view its installed version number. Alternatively, check the version in the file /protected/modules/calendar/module.json or via command line if accessible.Affected if The installed version is lower than 1.8.11 (e.g., 1.8.10, 1.8.0, etc.)
-
Verify Calendar module is enabledIn the HumHub admin panel under Modules > Installed Modules, confirm the Calendar module status shows as 'Enabled' or 'Installed'. Also check if the Calendar module appears in the user navigation menu.Affected if The Calendar module is installed and enabled, making the XSS vector accessible.
-
Check for existing Event TypesNavigate to Calendar module settings or the Event Types configuration area (typically found under Calendar > Settings > Event Types or similar path). Review all created event type entries for any unexpected or suspicious JavaScript code, HTML tags, or unusual character sequences in name/description fields.Affected if There are event types present in the system, particularly those created by administrative users, as this is where the malicious payload would be stored.
-
Review recent event type modificationsCheck the HumHub activity log or audit logs for recent changes to event type configurations, looking for entries with timestamps corresponding to potential compromise and noting which admin accounts made changes.Affected if Event types have been modified recently, especially if modifications were made by accounts that may have been compromised.
A user is affected if their HumHub Calendar module version is below 1.8.11 and the Calendar module with Event Types feature is enabled and populated with event type data.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped1.8.11
Update the HumHub Calendar module to version 1.8.11 or later to apply the security patch. Additionally, review recent admin-created event types for any suspicious content.
1.8.11
- 1. Backup your HumHub installation and database before performing any upgrade.
- 2. Navigate to the HumHub administration panel.
- 3. Go to the Modules section.
- 4. Locate the Calendar module in the installed modules list.
- 5. Check the current version of the Calendar module to confirm it is below 1.8.11.
- 6. If an update is available, use the 'Update' or 'Install' option in the module management interface to update to version 1.8.11.
- 7. Alternatively, if using Composer, run 'composer update humhub/calendar' to pull the latest version.
- 8. After updating, verify the module shows version 1.8.11 or higher.
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation1.0 h
- Implementation2.0 h
- Testing2.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,664.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-29052 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-29052 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data