flarum/framework Security Advisories | GitStock

medium2026-04-22

Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)

GHSA-xjvc-pw2r-6878 · CVE-2026-41887

medium2026-03-10

flarum/nicknames extension has display name injection in notification emails (autolink & markdown)

GHSA-3c4m-j3g4-hh25 · CVE-2026-30913

medium2025-03-12

Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite

GHSA-hg9j-64wp-m9px · CVE-2025-27794

high2023-08-16

Flarum vulnerable to LFI and Blind SSRF via Avatar upload

GHSA-67c6-q4j4-hccg · CVE-2023-40033

low2023-01-10

Any Flarum user including unactivated can reply in public discussions whose first post was permanently deleted

GHSA-hph3-hv3c-7725 · CVE-2023-22489

medium2023-01-10

Flarum notifications can leak restricted content

GHSA-8gcg-vwmw-rxj4 · CVE-2023-22488

high2023-01-10

Flarum post mentions can be used to read any post on the forum without access control

GHSA-22m9-m3ww-53h3 · CVE-2023-22487

critical2022-11-21

Cross site scripting vulnerability with discussion titles

GHSA-7x4w-j98p-854x · CVE-2022-41938