Vulnerabilities in Flarum
14 resultsCVE-2021-32671CRITICALXSS vulnerability with translatorEPSS 39.7%CVE-2024-21641MEDIUMFlarum's Logout Route allows open redirectsEPSS 1.1%CVE-2023-27577MEDIUMPath Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarumEPSS 0.9%CVE-2021-21283MEDIUMXSS in Flarum Sticky extension.EPSS 0.8%CVE-2022-41938CRITICALCross site scripting vulnerability with discussion titles in flarumEPSS 0.7%CVE-2023-22487HIGHPost mentions can be used to read any post on the forum without access controlEPSS 0.7%CVE-2023-22489LOWFlarum is missing authorization in discussion repliesEPSS 0.6%CVE-2024-58303HIGHFoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template SettingsEPSS 0.5%CVE-2025-27794MEDIUMFlarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie OverwriteEPSS 0.5%CVE-2023-40033HIGHServer-Side Request Forgery via Avatar upload in flarumEPSS 0.4%CVE-2026-41887MEDIUMFlarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)EPSS 0.4%CVE-2023-22488MEDIUMMissing authorization in FlarumEPSS 0.4%CVE-2024-58302MEDIUMFoF Pretty Mail 1.1.2 Local File Inclusion via Email Template SettingsEPSS 0.3%CVE-2026-30913MEDIUMflarum/nickname: Display name injection in notification emails (autolink & markdown)EPSS 0.2%