Flarum Framework vulnerabilities

• flarum framework, nextcloud flow, vaadin +2 more Push Endpoint Returns Permissive CORS Headers CVE-2026-110737 2.3 LowOctober 27, 2026
• flarum framework Laravel TokenGuard authentication bypass through non-string API credentials CVE-2026-114509 Public exploitFix available 9.2 CriticalOctober 21, 2026
• flarum framework Laravel relationship inclusion can trigger unauthorized data destruction CVE-2026-114508 Fix available 6.5 MediumOctober 21, 2026
• flarum framework Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8 CVE-2026-110803 8.7 HighOctober 21, 2026
• flarum framework Laravel: XSS in Debug Page Information CVE-2026-102279 Fix available 3.1 LowSeptember 28, 2026
• cleverbrush deep, framework +1 more cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution CVE-2026-78654 6.9 MediumAugust 25, 2026
• flarum framework, sangoma freepbx +1 more FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup CVE-2026-73661 8.6 HighAugust 13, 2026
• flarum framework Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation CVE-2026-39924 7.6 HighAugust 5, 2026
• flarum framework Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset CVE-2026-39923 9.2 CriticalAugust 5, 2026
• flarum framework CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay CVE-2026-48019 Public exploitFix available 8.9 HighJune 17, 2026
• flarum framework Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577) CVE-2026-41887 Fix available 4.9 MediumApril 22, 2026
• flarum framework, vaadin, vaadin vaadin-spreadsheet-flow +2 more Cross-site scripting in Action caption CVE-2025-15022 Fix available 4.8 MediumJanuary 5, 2026
• flarum framework, sangoma freepbx +1 more Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation CVE-2025-67722 5.7 MediumDecember 16, 2025
• sangoma freepbx, flarum framework +1 more FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header CVE-2025-66039 Public exploit 9.3 CriticalDecember 9, 2025
• sangoma freepbx, flarum framework +1 more FreePBX vulnerable to unauthenticated Denial of Service CVE-2025-59056 6.6 MediumSeptember 15, 2025
• flarum framework, sangoma freepbx +1 more FreePBX Post-Authenticated Command Injection CVE-2025-55211 6.3 MediumSeptember 15, 2025
• vaadin, vaadin vaadin-upload-flow, flarum framework +2 more Possibility to bypass file upload validation on the server-side CVE-2025-9467 Fix available 5.3 MediumSeptember 4, 2025
• adianti framework Adianti Framework deserialization CVE-2025-3590 5.3 MediumApril 14, 2025
• flarum, flarum framework +1 more Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite CVE-2025-27794 Fix available 6.8 MediumMarch 12, 2025
• flarum framework Wifi information acquisition vulnerability in Framework Services CVE-2020-12492 1.0 LowNovember 25, 2024
• flarum framework Framework Information Disclosure Vulnerability CVE-2020-12491 4.8 MediumNovember 25, 2024
• flarum, flarum framework +1 more Flarum's Logout Route allows open redirects CVE-2024-21641 Fix available 6.5 MediumJanuary 5, 2024
• flarum, flarum framework +1 more Server-Side Request Forgery via Avatar upload in flarum CVE-2023-40033 Fix available 7.1 HighAugust 16, 2023
• flarum, flarum framework +1 more Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarum CVE-2023-27577 Fix available 6.6 MediumMarch 10, 2023
• flarum, flarum framework +1 more Flarum is missing authorization in discussion replies CVE-2023-22489 Fix available 3.5 LowJanuary 10, 2023
• flarum, flarum framework +1 more Missing authorization in Flarum CVE-2023-22488 Fix available 6.8 MediumJanuary 10, 2023
• flarum, flarum framework +1 more Post mentions can be used to read any post on the forum without access control CVE-2023-22487 Fix available 7.7 HighJanuary 10, 2023
• flarum, flarum framework +1 more Cross site scripting vulnerability with discussion titles in flarum CVE-2022-41938 Fix available 9.0 CriticalNovember 19, 2022
• flarum framework, totaljs total.js +1 more Code injection in total.js CVE-2021-32831 Fix available 7.5 HighAugust 30, 2021
• flarum framework Laravel has a File Validation Bypass CVE-2025-27515 Public exploitFix available 6.9 MediumApril 29, 2021
• flarum framework, debian linux +1 more Laravel allows environment manipulation via query string CVE-2024-52301 Public exploitFix available EPSS 44.8% 8.7 HighApril 29, 2021
• flarum framework Blade `@parent` Exploitation Leading To Possible XSS in Laravel CVE-2021-43808 Fix available 5.3 MediumApril 29, 2021
• flarum framework, laravel +1 more Query Binding Exploitation in Laravel CVE-2021-21263 Fix available 7.2 HighJanuary 19, 2021
• graniteds, flarum framework +1 more The implementation of Action Message Format (AMF3) deserializers in GraniteDS, version 3.1.1.GA, may allow instantiation of arbitrary classes due to improper code control CVE-2017-3200 8.1 HighJune 11, 2018
• graniteds, flarum framework +1 more GraniteDS, version 3.1.1.GA, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization CVE-2017-3199 8.1 HighJune 11, 2018