Packagist/flarum/core

XSS vulnerability with translator

Modified: 7/8/2026

Flarum vulnerable to LFI and Blind SSRF via Avatar upload

Modified: 9/10/2026

Flarum's logout Route allows open redirects

Modified: 9/10/2026

Cross site scripting vulnerability with discussion titles

Modified: 11/8/2023

Flarum notifications can leak restricted content

Modified: 11/8/2023

Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite

Modified: 3/12/2025

Any Flarum user including unactivated can reply in public discussions whose first post was permanently deleted

Modified: 11/8/2023

Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files

Modified: 9/10/2026

Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)

Modified: 5/13/2026