Hubzero vulnerabilities
We track 2 vulnerabilities in Hubzero products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 17, 2026.
2vulnerabilities
0critical
2high
0exploited
8.4average CVSS score
Latest Hubzero vulnerabilities
- 8.1 High severity
hubzero-cms: Session Fixation
HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to fixate victim sessions. Attackers can obtain a valid session identifier, send victims a crafted link
- 8.8 High severity
hubzero-cms: Improper Limitation of a Pathname to a Restricted Directory
HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters