Security
فارسی
All products

flarum/core

Composer · Package
9 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Flarum's logout Route allows open redirectsCVE-2024-21641 · GHSA-733R-8XCP-W9MR flarum/coreflarum/framework Composer Medium Fix reported
Flarum vulnerable to LFI and Blind SSRF via Avatar uploadCVE-2023-40033 · GHSA-67C6-Q4J4-HCCG flarum/coreflarum/framework Composer High Fix reported
Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server filesCVE-2023-27577 · GHSA-VHM8-WWRF-3GCW flarum/core Composer Medium Fix reported
XSS vulnerability with translatorCVE-2021-32671 · GHSA-5QJQ-69W6-FG57 flarum/core Composer Critical Fix reported
Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)CVE-2026-41887 · GHSA-XJVC-PW2R-6878 flarum/core Composer Medium Fix reported
Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie OverwriteCVE-2025-27794 · GHSA-HG9J-64WP-M9PX flarum/coreflarum/framework Composer Medium Fix reported
Any Flarum user including unactivated can reply in public discussions whose first post was permanently deletedCVE-2023-22489 · GHSA-HPH3-HV3C-7725 flarum/core Composer Low Fix reported
Flarum notifications can leak restricted contentCVE-2023-22488 · GHSA-8GCG-VWMW-RXJ4 flarum/core Composer Medium Fix reported
Cross site scripting vulnerability with discussion titlesCVE-2022-41938 · GHSA-7X4W-J98P-854X flarum/core Composer Critical Fix reported