Log in Start free

Flarum

Products

ProductCVEsExploitedLatest
framework9–May 8, 2026
Flarum Framework2–Aug 5, 2026
FriendsofFlarum Pretty Mail2–Dec 11, 2025
Extension Manager1–Oct 19, 2026
core1–Jun 7, 2021
nicknames1–Mar 9, 2026
sticky1–Jan 26, 2021

Exploited and recent CVEs

  • CVE-2026-112291 Medium 5.3 Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing Authorization via Task API 0.3%
  • CVE-2026-39924 Medium 6.8 Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation 0.4%
  • CVE-2026-39923 High 8.1 Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset 0.4%
  • CVE-2026-41887 Medium 4.9 Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577) 0.5%
  • CVE-2026-30913 Medium 4.6 flarum/nickname: Display name injection in notification emails (autolink & markdown) 0.2%
  • CVE-2024-58303 High 8.6 FoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template Settings 0.5%
  • CVE-2024-58302 Medium 6.9 FoF Pretty Mail 1.1.2 Local File Inclusion via Email Template Settings 0.3%
  • CVE-2025-27794 Medium 6.8 Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite 0.5%
  • CVE-2024-21641 Medium 6.5 Flarum's Logout Route allows open redirects 1.1%
  • CVE-2023-40033 High 7.1 Server-Side Request Forgery via Avatar upload in flarum 0.5%
  • CVE-2023-27577 Medium 6.6 Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarum 0.9%
  • CVE-2023-22489 Low 3.5 Flarum is missing authorization in discussion replies 0.6%
  • CVE-2023-22488 Medium 6.8 Missing authorization in Flarum 0.4%
  • CVE-2023-22487 High 7.7 Post mentions can be used to read any post on the forum without access control 0.7%
  • CVE-2022-41938 Critical 9.0 Cross site scripting vulnerability with discussion titles in flarum 0.8%
  • CVE-2021-32671 Critical 10.0 XSS vulnerability with translator 40.0%
  • CVE-2021-21283 Medium 5.4 XSS in Flarum Sticky extension. 0.8%