CVE-2026-41887
1 advisory.
Packagist/flarum/core CVE-2026-41887: medium 4.9, EPSS 0.46%
Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)
Action: Upgrade flarum/core to 1.8.16 or later.
composer require flarum/core:1.8.16composer require flarum/core:2.0.0-rc.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.8.16 | - |
| 2.0.0-beta.1 | 2.0.0-rc.1 | - |
Fixed versions
| 1.8.16 | 2.0.0-rc.1 |
Sources
- osv: GHSA-xjvc-pw2r-6878
- https://github.com/flarum/framework/security/advisories/GHSA-vhm8-wwrf-3gcw
- https://github.com/flarum/framework/security/advisories/GHSA-xjvc-pw2r-6878
- https://nvd.nist.gov/vuln/detail/CVE-2023-27577
- https://nvd.nist.gov/vuln/detail/CVE-2026-41887
- https://github.com/flarum/framework/commit/2d90a1f19f0e46f8c7e1b07c48ba74b5e38f8410
- https://github.com/flarum/framework
- https://github.com/flarum/framework/releases/tag/v1.8.16
- https://github.com/flarum/framework/releases/tag/v2.0.0-rc.1
CVE-2026-41887 · published · modified · JSON