{"schema_version":1,"title":"grumpydictator/firefly-iii (Packagist) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 27 vulnerabilities in grumpydictator/firefly-iii (Packagist): 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-50886, was published on 15 June 2026.","url":"https://junglewise.ai/threats/technologies/grumpydictator-firefly-iii","json_url":"https://junglewise.ai/threats/technologies/grumpydictator-firefly-iii.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/grumpydictator-firefly-iii","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":0,"all_time":27,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":4},"latest":[{"cve":"CVE-2026-50886","cvss":9.1,"epss":0.0044,"slug":"cve-2026-50886-project-firefly-iii-ssrf-in-webhook-management-component","title":"Project Firefly III SSRF in webhook management component","severity":"critical","exploited":false,"published_at":"2026-06-15T20:16:31.58+00:00","url":"https://junglewise.ai/threats/cve-2026-50886-project-firefly-iii-ssrf-in-webhook-management-component"},{"cvss":5.1,"slug":"firefly-iii-stored-xss-in-audit-log-entry-via-piggy-bank-name-79c37ea2","title":"Firefly III Stored XSS in Audit Log Entry via piggy bank name","severity":"medium","exploited":false,"published_at":"2026-06-12T15:04:50+00:00","url":"https://junglewise.ai/threats/firefly-iii-stored-xss-in-audit-log-entry-via-piggy-bank-name-79c37ea2"},{"cvss":4,"slug":"firefly-ii-has-stored-xss-in-audit-log-entry-view-via-piggy-bank-name-083de903","title":"Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)","severity":"medium","exploited":false,"published_at":"2026-06-12T15:04:50+00:00","url":"https://junglewise.ai/threats/firefly-ii-has-stored-xss-in-audit-log-entry-view-via-piggy-bank-name-083de903"},{"cvss":4,"slug":"firefly-iii-user-api-endpoints-expose-all-users-information-to-any-28231c21","title":"Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)","severity":"medium","exploited":false,"published_at":"2026-03-07T02:10:45+00:00","url":"https://junglewise.ai/threats/firefly-iii-user-api-endpoints-expose-all-users-information-to-any-28231c21"},{"cve":"CVE-2024-37893","cvss":3.1,"epss":0.0059,"slug":"cve-2024-37893-firefly-iii-has-a-mfa-bypass-in-oauth-flow","title":"Firefly III has a MFA bypass in oauth flow","severity":"low","exploited":false,"published_at":"2024-06-17T22:28:28+00:00","url":"https://junglewise.ai/threats/cve-2024-37893-firefly-iii-has-a-mfa-bypass-in-oauth-flow"},{"cvss":3.1,"slug":"c5-firefly-iii-csv-injection-f3c22e29","title":"C5 Firefly III CSV Injection.","severity":"low","exploited":false,"published_at":"2024-01-31T18:05:46+00:00","url":"https://junglewise.ai/threats/c5-firefly-iii-csv-injection-f3c22e29"},{"cve":"CVE-2024-22075","cvss":3.1,"epss":0.0035,"slug":"cve-2024-22075-firefly-iii-allows-webhooks-html-injection","title":"Firefly III allows webhooks HTML Injection.","severity":"low","exploited":false,"published_at":"2024-01-05T03:30:37+00:00","url":"https://junglewise.ai/threats/cve-2024-22075-firefly-iii-allows-webhooks-html-injection"},{"cve":"CVE-2023-1788","cvss":3.1,"epss":0.0044,"slug":"cve-2023-1788-firefly-iii-insufficiently-expires-sessions","title":"Firefly III insufficiently expires sessions","severity":"low","exploited":false,"published_at":"2023-04-05T18:30:18+00:00","url":"https://junglewise.ai/threats/cve-2023-1788-firefly-iii-insufficiently-expires-sessions"},{"cve":"CVE-2023-1789","cvss":3.1,"epss":0.0034,"slug":"cve-2023-1789-firefly-iii-vulnerable-to-improper-input-validation","title":"Firefly III vulnerable to improper input validation","severity":"low","exploited":false,"published_at":"2023-04-01T03:30:16+00:00","url":"https://junglewise.ai/threats/cve-2023-1789-firefly-iii-vulnerable-to-improper-input-validation"},{"cve":"CVE-2023-0298","cvss":3.1,"epss":0.0063,"slug":"cve-2023-0298-improper-authorization-in-grumpydictator-firefly-iii","title":"Improper Authorization in grumpydictator/firefly-iii","severity":"low","exploited":false,"published_at":"2023-01-14T09:30:23+00:00","url":"https://junglewise.ai/threats/cve-2023-0298-improper-authorization-in-grumpydictator-firefly-iii"},{"cve":"CVE-2021-3846","cvss":3.1,"epss":0.0078,"slug":"cve-2021-3846-unrestricted-file-upload-vulnerability-in-firefly-iii","title":"Unrestricted File Upload vulnerability in Firefly III","severity":"low","exploited":false,"published_at":"2022-05-24T19:18:01+00:00","url":"https://junglewise.ai/threats/cve-2021-3846-unrestricted-file-upload-vulnerability-in-firefly-iii"},{"cve":"CVE-2019-13646","cvss":3,"epss":0.0076,"slug":"cve-2019-13646-firefly-iii-vulnerable-to-reflected-cross-site-scripting","title":"Firefly III vulnerable to reflected cross-site scripting","severity":"low","exploited":false,"published_at":"2022-05-24T16:50:37+00:00","url":"https://junglewise.ai/threats/cve-2019-13646-firefly-iii-vulnerable-to-reflected-cross-site-scripting"},{"cve":"CVE-2019-13645","cvss":3,"epss":0.0076,"slug":"cve-2019-13645-firefly-iii-vulnerable-to-stored-xss","title":"Firefly III vulnerable to stored XSS","severity":"low","exploited":false,"published_at":"2022-05-24T16:50:37+00:00","url":"https://junglewise.ai/threats/cve-2019-13645-firefly-iii-vulnerable-to-stored-xss"},{"cve":"CVE-2019-13647","cvss":3,"epss":0.0076,"slug":"cve-2019-13647-firefly-iii-vulnerable-to-image-based-stored-xss","title":"Firefly III vulnerable to image-based stored XSS","severity":"low","exploited":false,"published_at":"2022-05-24T16:50:37+00:00","url":"https://junglewise.ai/threats/cve-2019-13647-firefly-iii-vulnerable-to-image-based-stored-xss"},{"cve":"CVE-2019-13644","cvss":3.1,"epss":0.0076,"slug":"cve-2019-13644-firefly-iii-vulnerable-to-stored-xss","title":"Firefly III vulnerable to stored XSS","severity":"low","exploited":false,"published_at":"2022-05-24T16:50:36+00:00","url":"https://junglewise.ai/threats/cve-2019-13644-firefly-iii-vulnerable-to-stored-xss"},{"cve":"CVE-2021-4005","cvss":3.1,"epss":0.0043,"slug":"cve-2021-4005-cross-site-request-forgery-in-firefly-iii","title":"Cross Site Request Forgery in firefly-iii","severity":"low","exploited":false,"published_at":"2021-12-10T20:20:08+00:00","url":"https://junglewise.ai/threats/cve-2021-4005-cross-site-request-forgery-in-firefly-iii"},{"cve":"CVE-2021-4015","cvss":3.1,"epss":0.0044,"slug":"cve-2021-4015-firefly-iii-is-vulnerable-to-cross-site-request-forgery-csrf","title":"firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)","severity":"low","exploited":false,"published_at":"2021-12-06T17:19:18+00:00","url":"https://junglewise.ai/threats/cve-2021-4015-firefly-iii-is-vulnerable-to-cross-site-request-forgery-csrf"},{"cve":"CVE-2021-3921","cvss":3,"epss":0.0044,"slug":"cve-2021-3921-firefly-iii-is-vulnerable-to-cross-site-request-forgery-csrf","title":"firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)","severity":"low","exploited":false,"published_at":"2021-11-15T23:18:00+00:00","url":"https://junglewise.ai/threats/cve-2021-3921-firefly-iii-is-vulnerable-to-cross-site-request-forgery-csrf"},{"cve":"CVE-2021-3900","cvss":3.1,"epss":0.0055,"slug":"cve-2021-3900-cross-site-request-forgery-in-firefly-iii","title":"Cross-Site Request Forgery in firefly-iii","severity":"low","exploited":false,"published_at":"2021-10-28T23:14:21+00:00","url":"https://junglewise.ai/threats/cve-2021-3900-cross-site-request-forgery-in-firefly-iii"},{"cve":"CVE-2021-3901","cvss":3,"epss":0.0055,"slug":"cve-2021-3901-cross-site-request-forgery-in-firefly-iii","title":"Cross-Site Request Forgery in firefly-iii","severity":"low","exploited":false,"published_at":"2021-10-28T23:14:14+00:00","url":"https://junglewise.ai/threats/cve-2021-3901-cross-site-request-forgery-in-firefly-iii"},{"cve":"CVE-2021-3851","cvss":3,"epss":0.0057,"slug":"cve-2021-3851-open-redirect-in-firefly-iii","title":"Open Redirect in firefly-iii","severity":"low","exploited":false,"published_at":"2021-10-21T17:48:41+00:00","url":"https://junglewise.ai/threats/cve-2021-3851-open-redirect-in-firefly-iii"},{"cve":"CVE-2021-3819","cvss":3,"epss":0.0054,"slug":"cve-2021-3819-cross-site-request-forgery-in-firefly-iii","title":"Cross-Site Request Forgery in firefly-iii","severity":"low","exploited":false,"published_at":"2021-09-29T17:12:37+00:00","url":"https://junglewise.ai/threats/cve-2021-3819-cross-site-request-forgery-in-firefly-iii"},{"cve":"CVE-2019-14671","cvss":3,"epss":0.0047,"slug":"cve-2019-14671-improper-input-validation-in-firefly-iii","title":"Improper Input Validation in Firefly III","severity":"low","exploited":false,"published_at":"2021-09-08T17:27:07+00:00","url":"https://junglewise.ai/threats/cve-2019-14671-improper-input-validation-in-firefly-iii"},{"cve":"CVE-2021-3728","cvss":3,"epss":0.005,"slug":"cve-2021-3728-firefly-iii-is-vulnerable-to-cross-site-request-forgery-csrf","title":"firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)","severity":"low","exploited":false,"published_at":"2021-08-25T14:50:17+00:00","url":"https://junglewise.ai/threats/cve-2021-3728-firefly-iii-is-vulnerable-to-cross-site-request-forgery-csrf"},{"cve":"CVE-2021-3730","cvss":3,"epss":0.0048,"slug":"cve-2021-3730-firefly-iii-is-vulnerable-to-cross-site-request-forgery-csrf","title":"firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)","severity":"low","exploited":false,"published_at":"2021-08-25T14:50:08+00:00","url":"https://junglewise.ai/threats/cve-2021-3730-firefly-iii-is-vulnerable-to-cross-site-request-forgery-csrf"}],"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"wwbn/avideo (Packagist)","slug":"wwbn-avideo","vulnerabilities":169,"url":"https://junglewise.ai/threats/technologies/wwbn-avideo"},{"name":"getgrav/grav (Packagist)","slug":"getgrav-grav","vulnerabilities":144,"url":"https://junglewise.ai/threats/technologies/getgrav-grav"},{"name":"thorsten/phpmyfaq (Packagist)","slug":"thorsten-phpmyfaq","vulnerabilities":138,"url":"https://junglewise.ai/threats/technologies/thorsten-phpmyfaq"},{"name":"pimcore/pimcore (Packagist)","slug":"pimcore-pimcore","vulnerabilities":136,"url":"https://junglewise.ai/threats/technologies/pimcore-pimcore"},{"name":"dolibarr/dolibarr (Packagist)","slug":"dolibarr-dolibarr","vulnerabilities":125,"url":"https://junglewise.ai/threats/technologies/dolibarr-dolibarr"},{"name":"drupal/core (Packagist)","slug":"packagist-drupal-core","vulnerabilities":116,"url":"https://junglewise.ai/threats/technologies/packagist-drupal-core"},{"name":"librenms/librenms (Packagist)","slug":"librenms-librenms","vulnerabilities":113,"url":"https://junglewise.ai/threats/technologies/librenms-librenms"},{"name":"microweber/microweber (Packagist)","slug":"microweber-microweber","vulnerabilities":106,"url":"https://junglewise.ai/threats/technologies/microweber-microweber"},{"name":"concrete5/concrete5 (Packagist)","slug":"concrete5-concrete5","vulnerabilities":93,"url":"https://junglewise.ai/threats/technologies/concrete5-concrete5"},{"name":"craftcms/cms (Packagist)","slug":"craftcms-cms","vulnerabilities":90,"url":"https://junglewise.ai/threats/technologies/craftcms-cms"},{"name":"snipe/snipe-it (Packagist)","slug":"snipe-snipe-it","vulnerabilities":80,"url":"https://junglewise.ai/threats/technologies/snipe-snipe-it"},{"name":"phpmyfaq/phpmyfaq (Packagist)","slug":"phpmyfaq-phpmyfaq","vulnerabilities":75,"url":"https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq"}],"technology":{"hub":true,"name":"grumpydictator/firefly-iii (Packagist)","slug":"grumpydictator-firefly-iii","vendor":{"name":"Packagist","slug":"packagist","url":"https://junglewise.ai/threats/vendors/packagist"},"aliases":[],"homepage":"https://firefly-iii.org/","repo_url":"https://github.com/firefly-iii/firefly-iii","description":"A self-hosted personal finance manager.","url":"https://junglewise.ai/threats/technologies/grumpydictator-firefly-iii"},"most_severe":[{"cve":"CVE-2026-50886","cvss":9.1,"epss":0.0044,"slug":"cve-2026-50886-project-firefly-iii-ssrf-in-webhook-management-component","title":"Project Firefly III SSRF in webhook management component","severity":"critical","exploited":false,"published_at":"2026-06-15T20:16:31.58+00:00","url":"https://junglewise.ai/threats/cve-2026-50886-project-firefly-iii-ssrf-in-webhook-management-component"},{"cvss":5.1,"slug":"firefly-iii-stored-xss-in-audit-log-entry-via-piggy-bank-name-79c37ea2","title":"Firefly III Stored XSS in Audit Log Entry via piggy bank name","severity":"medium","exploited":false,"published_at":"2026-06-12T15:04:50+00:00","url":"https://junglewise.ai/threats/firefly-iii-stored-xss-in-audit-log-entry-via-piggy-bank-name-79c37ea2"},{"cvss":4,"slug":"firefly-ii-has-stored-xss-in-audit-log-entry-view-via-piggy-bank-name-083de903","title":"Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)","severity":"medium","exploited":false,"published_at":"2026-06-12T15:04:50+00:00","url":"https://junglewise.ai/threats/firefly-ii-has-stored-xss-in-audit-log-entry-view-via-piggy-bank-name-083de903"},{"cvss":4,"slug":"firefly-iii-user-api-endpoints-expose-all-users-information-to-any-28231c21","title":"Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)","severity":"medium","exploited":false,"published_at":"2026-03-07T02:10:45+00:00","url":"https://junglewise.ai/threats/firefly-iii-user-api-endpoints-expose-all-users-information-to-any-28231c21"},{"cve":"CVE-2021-3846","cvss":3.1,"epss":0.0078,"slug":"cve-2021-3846-unrestricted-file-upload-vulnerability-in-firefly-iii","title":"Unrestricted File Upload vulnerability in Firefly III","severity":"low","exploited":false,"published_at":"2022-05-24T19:18:01+00:00","url":"https://junglewise.ai/threats/cve-2021-3846-unrestricted-file-upload-vulnerability-in-firefly-iii"},{"cve":"CVE-2019-13644","cvss":3.1,"epss":0.0076,"slug":"cve-2019-13644-firefly-iii-vulnerable-to-stored-xss","title":"Firefly III vulnerable to stored XSS","severity":"low","exploited":false,"published_at":"2022-05-24T16:50:36+00:00","url":"https://junglewise.ai/threats/cve-2019-13644-firefly-iii-vulnerable-to-stored-xss"},{"cve":"CVE-2023-0298","cvss":3.1,"epss":0.0063,"slug":"cve-2023-0298-improper-authorization-in-grumpydictator-firefly-iii","title":"Improper Authorization in grumpydictator/firefly-iii","severity":"low","exploited":false,"published_at":"2023-01-14T09:30:23+00:00","url":"https://junglewise.ai/threats/cve-2023-0298-improper-authorization-in-grumpydictator-firefly-iii"},{"cve":"CVE-2024-37893","cvss":3.1,"epss":0.0059,"slug":"cve-2024-37893-firefly-iii-has-a-mfa-bypass-in-oauth-flow","title":"Firefly III has a MFA bypass in oauth flow","severity":"low","exploited":false,"published_at":"2024-06-17T22:28:28+00:00","url":"https://junglewise.ai/threats/cve-2024-37893-firefly-iii-has-a-mfa-bypass-in-oauth-flow"},{"cve":"CVE-2021-3900","cvss":3.1,"epss":0.0055,"slug":"cve-2021-3900-cross-site-request-forgery-in-firefly-iii","title":"Cross-Site Request Forgery in firefly-iii","severity":"low","exploited":false,"published_at":"2021-10-28T23:14:21+00:00","url":"https://junglewise.ai/threats/cve-2021-3900-cross-site-request-forgery-in-firefly-iii"},{"cve":"CVE-2023-1788","cvss":3.1,"epss":0.0044,"slug":"cve-2023-1788-firefly-iii-insufficiently-expires-sessions","title":"Firefly III insufficiently expires sessions","severity":"low","exploited":false,"published_at":"2023-04-05T18:30:18+00:00","url":"https://junglewise.ai/threats/cve-2023-1788-firefly-iii-insufficiently-expires-sessions"}],"generated_at":"2026-09-28T03:07:00.154823+00:00"}