Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

flarum/core

9 known vulnerabilities (2 critical, 1 high, 5 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
9 · 2 critical, 1 high, 5 medium, 1 low
Registry
Packagist

Advisories 9

  • CVE-2026-41887Medium 4.9

    Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)

    Affected: fixed in 1.8.16; from 2.0.0-beta.1, fixed in 2.0.0-rc.1.

  • CVE-2025-27794Medium 6.8

    Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite

    Affected: fixed in 1.8.10.

  • CVE-2024-21641Medium 6.5

    Flarum's Logout Route allows open redirects

    Affected: fixed in 1.8.5.

  • Server-Side Request Forgery via Avatar upload in flarum

    Affected: fixed in 1.8.0.

  • CVE-2023-27577Medium 6.6

    Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarum

    Affected: fixed in 1.7.0.

  • Flarum is missing authorization in discussion replies

    Affected: from 1.3.0, fixed in 1.6.3.

  • CVE-2023-22488Medium 6.8

    Missing authorization in Flarum

    Affected: fixed in 1.6.3.

  • CVE-2022-41938Critical 9.0

    Cross site scripting vulnerability with discussion titles in flarum

    Affected: from 1.5.0, fixed in 1.6.2.

  • CVE-2021-32671Critical 10.0

    XSS vulnerability with translator

    Affected: from 1.0.0, fixed in 1.0.2.