Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

flarum/framework

4 known vulnerabilities (1 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 1 high, 2 medium
Registry
Packagist

Advisories 4

  • CVE-2025-27794Medium 6.8

    Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite

    Affected: fixed in 1.8.10.

  • CVE-2024-21641Medium 6.5

    Flarum's Logout Route allows open redirects

    Affected: fixed in 1.8.5.

  • Server-Side Request Forgery via Avatar upload in flarum

    Affected: fixed in 1.8.0.

  • In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address.

    Affected: through 0.1.0-beta.7.1.