Skip to content
OpenAdvisories

Package · Packagist

flarum/framework

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 6.8
    CVE-2025-27794

    Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite

    Flarum is open-source forum software. A session hijacking vulnerability exists in versions prior to 1.8.10 when an attacker-controlled authoritative subdomain under a parent domain (e.g., `subdomain.host.com`) sets cookies scoped to the parent domain (`.host.…

    flarum framework flarum/core flarum/framework Packagist
  • Medium 6.5
    CVE-2024-21641

    Flarum's Logout Route allows open redirects

    Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum `/logout` route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. For …

    flarum framework flarum/core flarum/framework Packagist
  • High 7.1
    CVE-2023-40033

    Server-Side Request Forgery via Avatar upload in flarum

    Flarum is an open source forum software. Flarum is affected by a vulnerability that allows an attacker to conduct a Blind Server-Side Request Forgery (SSRF) attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uplo…

    flarum framework flarum/core flarum/framework Packagist
  • Medium 5.3
    CVE-2018-19133

    Flarum Core Leaks PII

    In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address.

    flarum/framework Packagist