Vulnerability Database · Packagist · flarum/core · Version
flarum/core v1.4.1
v1.4.1 is affected by 7 vulnerabilities.
The vulnerabilities that cover this exact version are listed below with the fixed version to move to.
Critical 0 High 1 Medium 5 Low 1 Unrated 0
-
Database updated 23/Oct/2026
Concerned about your application's security?
Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.
01 Vulnerabilities affecting this version
flarum/core v1.4.1 vulnerabilities
7 vulnerabilities cover flarum/core v1.4.1. Open the full list in the database.
| Vulnerability | Severity | Fixed version | Disclosed |
|---|---|---|---|
| CVE-2023-40033: Flarum vulnerable to LFI and Blind SSRF via Avatar upload | 7.1 high | 1.8.0 | 16 Aug 2023 |
| CVE-2025-27794: Flarum Session Hijacking Vulnerability via Authoritative Subdomain Cookie Overwrite | 6.8 medium | 1.8.10 | 12 Mar 2025 |
| CVE-2023-22488: Flarum Core - Flarum notifications can leak restricted content | 6.8 medium | 1.6.3 | 10 Jan 2023 |
| CVE-2024-21641: Flarum's logout Route allows open redirects | 6.5 medium | 1.8.5 | 05 Jan 2024 |
| CVE-2023-27577: Path Traversal Vulnerability in flarum/core | 6.5 medium | 1.7.0 | 13 Mar 2023 |
| Path Traversal Vulnerability in Flarum's LESS Parser: Incomplete Fix for CVE-2023-27577 | 4.9 medium | 1.8.16 | 22 Apr 2026 |
| CVE-2023-22489: Flarum Core - Uncontrolled Reply Creation in Public Discussions | 3.5 low | 1.6.3 | 10 Jan 2023 |
Looking for another version, or everything Vulert holds for flarum/core?
Questions
About flarum/core v1.4.1
Is flarum/core v1.4.1 vulnerable?
Yes. 7 vulnerabilities in the Vulert database cover flarum/core v1.4.1: 0 critical, 1 high, 5 medium and 1 low. Each entry above names the fixed version to move to.
How do I monitor flarum/core for upcoming vulnerabilities?
Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the flarum/core version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.