flarum framework vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20235
3. 20241
4. 20251
5. 20261

Newest CVEs

• CVE-2026-41887

  Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)

  flarum · framework

  Medium4.9
• CVE-2025-27794

  Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite

  flarum · framework

  Medium6.8
• CVE-2024-21641

  Flarum's Logout Route allows open redirects

  flarum · framework

  Medium6.5
• CVE-2023-40033

  Server-Side Request Forgery via Avatar upload in flarum

  flarum · framework

  High7.1
• CVE-2023-27577

  Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarum

  flarum · framework

  Medium6.6
• CVE-2023-22489

  Flarum is missing authorization in discussion replies

  flarum · framework

  Low3.5
• CVE-2023-22488

  Missing authorization in Flarum

  flarum · framework

  Medium6.8
• CVE-2023-22487

  Post mentions can be used to read any post on the forum without access control

  flarum · framework

  High7.7
• CVE-2022-41938

  Cross site scripting vulnerability with discussion titles in flarum

  flarum · framework

  Critical9.0