Flarum framework

• CVE-2026-41887 Medium 4.9 Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577) 0.5%
• CVE-2025-27794 Medium 6.8 Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite 0.5%
• CVE-2024-21641 Medium 6.5 Flarum's Logout Route allows open redirects 1.1%
• CVE-2023-40033 High 7.1 Server-Side Request Forgery via Avatar upload in flarum 0.5%
• CVE-2023-27577 Medium 6.6 Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarum 0.9%
• CVE-2023-22489 Low 3.5 Flarum is missing authorization in discussion replies 0.6%
• CVE-2023-22488 Medium 6.8 Missing authorization in Flarum 0.4%
• CVE-2023-22487 High 7.7 Post mentions can be used to read any post on the forum without access control 0.7%
• CVE-2022-41938 Critical 9.0 Cross site scripting vulnerability with discussion titles in flarum 0.8%