Packagist/flarum/core CVE-2023-40033: high 7.1, EPSS 0.50%
Flarum vulnerable to LFI and Blind SSRF via Avatar upload
Action: Upgrade flarum/core to 1.8.0 or later.
composer require flarum/core:1.8.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.8.0 | - |
Fixed versions
| 1.8.0 |
Sources
- osv: GHSA-67c6-q4j4-hccg
- https://github.com/flarum/framework/security/advisories/GHSA-67c6-q4j4-hccg
- https://nvd.nist.gov/vuln/detail/CVE-2023-40033
- https://github.com/flarum/framework/commit/d1059c1cc79fe61f9538f3da55e8f42abbede570
- https://github.com/flarum/framework
CVE-2023-40033 · published · modified · JSON