flarum/core vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-41887Mediumflarum/core: Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)CVE-2025-27794Mediumflarum/core: Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite CVE-2024-21641Mediumflarum/core: Flarum's logout Route allows open redirects CVE-2023-40033Highflarum/core: Flarum vulnerable to LFI and Blind SSRF via Avatar upload CVE-2023-27577Mediumflarum/core: Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files CVE-2023-22489Lowflarum/core: Any Flarum user including unactivated can reply in public discussions whose first post was permanently deleted CVE-2023-22488Mediumflarum/core: Flarum notifications can leak restricted content CVE-2022-41938Criticalflarum/core: Cross site scripting vulnerability with discussion titles CVE-2021-32671Criticalflarum/core: XSS vulnerability with translator

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo