framework
v1.8.21Simple forum software for building great communities.
- Maintenance
- Active595 commits in 3 months · bus factor 2
- License
- MITPermissive · OSI-approved
- Security
- 15 advisories3 critical, 5 high, 5 medium, 2 low
- Supported versions
- No scheduleendoflife.date does not track this project
6.8k stars · 891 forks · 100 open issues · last release 22 days ago · data checked 2 hours ago
Security advisories
All advisories on GitHubThe 15 most recent advisories published by the maintainers: 3 critical, 5 high, 5 medium, 2 low. Check the patched version against the one you run.
- highGHSA-3gcq-q292-8cfpNov 6, 2026Stored XSS in flarum/mentions when selecting text in a post
- Affected
- >= 2.0.0-beta.1, < 2.0.3; < 1.8.7
- Patched in
- 2.0.3; 1.8.7
- highGHSA-fqc7-2f6r-m84cOct 23, 2026Privilege escalation to administrator via malformed group id in editGroups
- Affected
- >= 0.1.0-beta, <= 1.8.20
- Patched in
- 1.8.21
- criticalGHSA-55f2-h36g-96c3Aug 13, 2026Account takeover via password-reset token integer type juggling
- Affected
- <= 1.8.18; >= 2.0.0-beta.1, < 2.0.0-rc.1
- Patched in
- 1.8.19; 2.0.0-rc.1
- mediumCVE-2026-41887Apr 18, 2026Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)
- Affected
- <= 1.8.15; >= 2.0.0-beta.1, <= 2.0.0-beta.8
- Patched in
- 1.8.16; 2.0.0-rc.1
- mediumCVE-2026-30913Mar 8, 2026Display name injection in notification emails (autolink & markdown)
- Affected
- < 1.8.3
- Patched in
- 1.8.3
- mediumCVE-2025-27794Mar 12, 2025Session Hijacking via Authoritative Subdomain Cookie Overwrite
- Affected
- < 1.8.10
- Patched in
- 1.8.10
- lowCVE-2024-21641Jan 5, 2024Logout Route allows open redirects
- Affected
- < 1.8.5
- Patched in
- 1.8.5
- highCVE-2023-40033Aug 16, 2023LFI and Blind SSRF via Avatar upload
- Affected
- < 1.8.0
- Patched in
- 1.8.0
- mediumCVE-2023-27577Mar 10, 2023Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files
- Affected
- < 1.6.3
- Patched in
- 1.7.0
- lowCVE-2023-22489Jan 10, 2023Any user including unactivated can reply in public discussions whose first post was permanently deleted
- Affected
- < 1.3.0
- Patched in
- 1.6.3
- mediumCVE-2023-22488Jan 10, 2023Notifications can leak restricted content
- Affected
- < 1.6.3
- Patched in
- 1.6.3
- highCVE-2023-22487Jan 10, 2023Post mentions can be used to read any post on the forum without access control
- Affected
- < 1.6.3
- Patched in
- 1.6.3
- criticalCVE-2022-41938Nov 18, 2022XSS vulnerability with discussion titles
- Affected
- >=1.5.0, <1.6.2
- Patched in
- 1.6.2
- criticalCVE-2021-32671Jun 6, 2021XSS vulnerability with translator
- Affected
- 1.0.0, 1.0.1
- Patched in
- 1.0.2
- highCVE-2019-13183Jul 5, 2019CSRF attack prevention was skipped
- Affected
- <=0.1.0-beta.8
- Patched in
- 0.1.0-beta.9