hubzero-cms vulnerabilities

2 known vulnerabilities in hubzero-cms from Hubzero. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  hubzero-cms: Session Fixation

  CVE-2026-92984Sep 17, 2026Hubzero

  HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to fixate victim sessions. Attackers can obtain a valid session identifier, send victims a crafted link

• 8.8 High severity

  hubzero-cms: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-92970Sep 17, 2026Hubzero

  HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters