Skip to content
OpenAdvisories

Vendor

flarum

17 known vulnerabilities.

Products

framework 9 Flarum Framework 2 FriendsofFlarum Pretty Mail 2 core 1 Extension Manager 1 nicknames 1 sticky 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.1
    CVE-2026-39923

    Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset

    Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() me…

    flarum Flarum Framework
  • High 8.6
    CVE-2024-58303

    FoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template Settings

    FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. Attackers can execute system commands by inserting crafted template expressions that trigger arbitrar…

    flarum FriendsofFlarum Pretty Mail fof/pretty-mail Packagist
  • High 7.1
    CVE-2023-40033

    Server-Side Request Forgery via Avatar upload in flarum

    Flarum is an open source forum software. Flarum is affected by a vulnerability that allows an attacker to conduct a Blind Server-Side Request Forgery (SSRF) attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uplo…

    flarum framework flarum/core flarum/framework Packagist
  • High 7.7
    CVE-2023-22487

    Post mentions can be used to read any post on the forum without access control

    Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special `@"<username>"#p<id>` syntax. The following behavior never changes no matter…

    flarum framework flarum/mentions Packagist