flarum vulnerabilities

CVEs per yearBy the year they were published

1. 20212
2. 20221
3. 20235
4. 20241
5. 20253
6. 20265

Newest CVEs

• CVE-2026-112291

  Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing Authorization via Task API

  Flarum · Extension Manager

  Medium6.9
• CVE-2026-39924

  Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation

  Flarum · Flarum Framework

  High7.6
• CVE-2026-39923

  Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset

  Flarum · Flarum Framework

  Critical9.2
• CVE-2026-41887

  Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)

  flarum · framework

  Medium4.9
• CVE-2026-30913

  flarum/nickname: Display name injection in notification emails (autolink & markdown)

  flarum · nicknames

  Medium4.6
• CVE-2024-58303

  FoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template Settings

  Flarum · FriendsofFlarum Pretty Mail

  High8.6
• CVE-2024-58302

  FoF Pretty Mail 1.1.2 Local File Inclusion via Email Template Settings

  Flarum · FriendsofFlarum Pretty Mail

  Medium6.9
• CVE-2025-27794

  Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite

  flarum · framework

  Medium6.8
• CVE-2024-21641

  Flarum's Logout Route allows open redirects

  flarum · framework

  Medium6.5
• CVE-2023-40033

  Server-Side Request Forgery via Avatar upload in flarum

  flarum · framework

  High7.1