Flarum vulnerable to LFI and Blind SSRF via Avatar upload
Impact
The Flarum forum software is affected by a vulnerability that allows an attacker to conduct a Blind SSRF attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uploading a file containing a URL and spoofing the MIME type, an attacker can manipulate the application to execute unintended actions. The vulnerability is due to the behavior of the intervention/image package, which attempts to interpret the supplied file contents as a URL, which then fetches its contents. This allows an attacker to exploit the vulnerability to perform SSRF attacks, disclose local file contents, or conduct a blind oracle attack.
Patches
This has been patched in Flarum v1.8.
Workarounds
As a temporary workaround for the SSRF aspect of the vulnerability, one can disable PHP's allow_url_fopen which will prevent the fetching of external files via URLs.
Credits
Adam Kues - Assetnote
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | flarum/core | < 1.8.0 | 1.8.0 |
| Composer package | flarum/framework | < 1.8.0 | 1.8.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N- Weakness (CWE)
CWE-918, CWE-98- Platform
- Composer
- Package
flarum/core, flarum/framework- Disclosed
- 16.08.2023
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-67c6-q4j4-hccg - CC BY 4.0
Vulnerability history: flarum/framework
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 05.2022 03.2025
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 3
Disclosures per year
- 2022: 1
- 2023: 1
- 2024: 1
- 2025: 1
- 2026: 0
-
Flarum vulnerable to LFI and Blind SSRF via Avatar upload this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.