Known vulnerabilities in Flarum

Known vulnerabilities in Flarum

Vendor: Flarum

Software: Flarum

Software CPE: cpe:2.3:a:flarum:flarum_framework:*:*:*:*:*:*:*:*

Website: https://flarum.org/

Total vulnerabilities: 12

Public exploits: 0

Known exploited (KEV): 0

Highest CVSSv4 Score: 8.6

Breakdown by Severity Chart

Vulnerabilities (12)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU126537 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2026-41887	CWE-22	Low	No	No	1.8.16, 2.0.0 rc.1	20.04.2026	SB2026042066
#VU126535 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-30913	CWE-79	Low	No	No	1.8.3	20.04.2026	SB2026042065
#VU126534 - Session Fixation CVE-2025-27794	CWE-384	Medium	No	No	1.8.10	12.03.2025	SB2025031285
#VU85076 - URL Redirection to Untrusted Site ('Open Redirect') CVE-2024-21641	CWE-601	Low	No	No	1.8.5	08.01.2024	SB2024010837
#VU126533 - Server-Side Request Forgery (SSRF) CVE-2023-40033	CWE-918	Low	No	No	1.8.0	16.08.2023	SB20230816280
#VU126529 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2023-27577	CWE-22	Low	No	No	1.7.0	10.03.2023	SB2023031053
#VU71385 - Missing Authorization CVE-2023-22488	CWE-862	Medium	No	No	1.6.3	20.01.2023	SB2023012021
#VU71384 - Improper Access Control CVE-2023-22487	CWE-284	Medium	No	No	1.6.3	20.01.2023	SB2023012021
#VU126530 - Missing Authorization CVE-2023-22489	CWE-862	Low	No	No	1.6.3	10.01.2023	SB2023012021
#VU126531 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2022-41938	CWE-79	Low	No	No	1.6.2	18.11.2022	SB2022111865
#VU126532 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2021-32671	CWE-79	Medium	No	No	1.0.2	06.06.2021	SB2021060601
#VU126538 - Cross-Site Request Forgery (CSRF) CVE-2019-13183	CWE-352	Medium	No	No	0.1.0 beta.9	05.07.2019	SB2019070512