flarum Framework Vulnerabilities

Flarum Framework vulnerabilities.

JSON RSS CSV 🔔 Create Alert Trigger

12 March 2025

Session Hijacking Vulnerability in Flarum Forum Software by Flarum
CVE-2025-27794
FlarumFramework6.8MEDIUM

5 January 2024

Flarum's Logout Route allows open redirects
CVE-2024-21641
FlarumFrameworkEPSS 32%6.5MEDIUM

16 August 2023

Server-Side Request Forgery via Avatar upload in flarum
CVE-2023-40033
FlarumFramework7.1HIGH

10 March 2023

Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarum
CVE-2023-27577
FlarumFramework6.6MEDIUM

13 January 2023

Flarum is missing authorization in discussion replies
CVE-2023-22489
FlarumFramework3.5LOW

12 January 2023

Missing authorization in Flarum
CVE-2023-22488
FlarumFramework6.8MEDIUM

11 January 2023

Post mentions can be used to read any post on the forum without access control
CVE-2023-22487
FlarumFramework7.7HIGH

19 November 2022

Cross site scripting vulnerability with discussion titles in flarum
CVE-2022-41938
FlarumFramework9CRITICAL