flarum/core vulnerabilities (Packagist)

9 vulnerabilities.

• flarum/core Packagist Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577) CVE-2026-41887 Fix available 4.9 MediumApril 22, 2026
• flarum/core Packagist Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite CVE-2025-27794 Fix available 6.8 MediumMarch 12, 2025
• flarum/core Packagist Flarum's Logout Route allows open redirects CVE-2024-21641 Fix available 6.5 MediumJanuary 5, 2024
• flarum/core Packagist Server-Side Request Forgery via Avatar upload in flarum CVE-2023-40033 Fix available 7.1 HighAugust 16, 2023
• flarum/core Packagist Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarum CVE-2023-27577 Fix available 6.6 MediumMarch 10, 2023
• flarum/core Packagist Flarum is missing authorization in discussion replies CVE-2023-22489 Fix available 3.5 LowJanuary 10, 2023
• flarum/core Packagist Missing authorization in Flarum CVE-2023-22488 Fix available 6.8 MediumJanuary 10, 2023
• flarum/core Packagist Cross site scripting vulnerability with discussion titles in flarum CVE-2022-41938 Fix available 9.0 CriticalNovember 19, 2022
• flarum/core Packagist XSS vulnerability with translator CVE-2021-32671 Fix available EPSS 40.0% 10.0 CriticalJune 7, 2021