Skip to content
OpenAdvisories

Product · flarum

framework

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.1
    CVE-2023-40033

    Server-Side Request Forgery via Avatar upload in flarum

    Flarum is an open source forum software. Flarum is affected by a vulnerability that allows an attacker to conduct a Blind Server-Side Request Forgery (SSRF) attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uplo…

    flarum framework flarum/core flarum/framework Packagist
  • High 7.7
    CVE-2023-22487

    Post mentions can be used to read any post on the forum without access control

    Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special `@"<username>"#p<id>` syntax. The following behavior never changes no matter…

    flarum framework flarum/mentions Packagist