Flarum vulnerabilities
We track 3 vulnerabilities in Flarum products across 4 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 5, 2026.
Latest Flarum vulnerabilities
- 8.1 High severity
Flarum Framework: Use of a Key Past its Expiration Date
Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() met
- 8.6 High severity
FriendsofFlarum Pretty Mail: Improper Neutralization of Special Elements Used in a Template Engine
FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. Attackers can execute system commands by inserting crafted template expressions that trigger arbitrary
- 7.1 High severity
framework: Server-Side Request Forgery
Flarum is an open source forum software. Flarum is affected by a vulnerability that allows an attacker to conduct a Blind Server-Side Request Forgery (SSRF) attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uploa