hubzero-cms vulnerabilities

Latest hubzero-cms CVEs

Newest publication first

1. CVE-2026-92984 HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifier

   Published 2026-09-17

   High·CVSS 8.5 EPSS 0.46%

   HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to fixate victim sessions. Attackers can obtain a valid session identifier, send victims a crafted link containing it, and...

2. CVE-2026-92970 HUBzero CMS through 2.2.32 Path Traversal via File Upload

   Published 2026-09-17

   High·CVSS 8.7 EPSS 0.82%

   HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to at...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.