Executive brief
Flarum is an open-source forum platform. A security flaw allows an authenticated administrator to read sensitive files from the server or access internal network resources by manipulating theme settings. This could lead to the exposure of database credentials, API keys, or other private configuration data.
Technical details
An incomplete fix for a previous vulnerability (CVE-2023-27577) failed to restrict @import and data-uri() directives in all LESS configuration variables. While 'custom_less' was protected, other variables like 'theme_primary_color' and 'theme_secondary_color' are interpolated verbatim into the LESS source at compile time. An authenticated administrator can inject an '@import (inline)' directive to include local files (e.g., /etc/passwd, .env) or trigger SSRF requests. The contents of the imported files or external responses are then embedded into the publicly accessible forum.css file. The issue is fixed in versions 1.8.16 and 2.0.0-rc.1.
Affected products
- Flarum Flarum core <= 1.8.15, >= 2.0.0-beta.1, <= 2.0.0-beta.8
Timeline
- 2026-04-18: advisory: GitHub Security Advisory published
- 2026-04-18: patched: Version 1.8.16 released
- 2026-04-20: patched: Version 2.0.0-rc.1 released
- 2026-05-08: disclosed: CVE-2026-41887 published to NVD