# grumpydictator/firefly-iii (Packagist) vulnerabilities Source: https://junglewise.ai/threats/technologies/grumpydictator-firefly-iii Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/grumpydictator-firefly-iii.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 26 vulnerabilities in grumpydictator/firefly-iii (Packagist): 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-50886, was published on 15 June 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 26 (1 critical, 0 exploited in the wild) ## About grumpydictator/firefly-iii (Packagist) A self-hosted personal finance manager. ## Latest grumpydictator/firefly-iii (Packagist) vulnerabilities - [CVE-2026-50886: Project Firefly III SSRF in webhook management component](https://junglewise.ai/threats/cve-2026-50886-project-firefly-iii-ssrf-in-webhook-management-component) (critical, CVSS 9.1, published 15 Jun 2026) - [Firefly III Stored XSS in Audit Log Entry via piggy bank name](https://junglewise.ai/threats/firefly-iii-stored-xss-in-audit-log-entry-via-piggy-bank-name-79c37ea2) (medium, CVSS 5.1, published 12 Jun 2026) - [Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)](https://junglewise.ai/threats/firefly-iii-user-api-endpoints-expose-all-users-information-to-any-28231c21) (medium, CVSS 4, published 7 Mar 2026) - [CVE-2024-37893: Firefly III has a MFA bypass in oauth flow](https://junglewise.ai/threats/cve-2024-37893-firefly-iii-has-a-mfa-bypass-in-oauth-flow) (low, CVSS 3.1, published 17 Jun 2024) - [C5 Firefly III CSV Injection.](https://junglewise.ai/threats/c5-firefly-iii-csv-injection-f3c22e29) (low, CVSS 3.1, published 31 Jan 2024) - [CVE-2024-22075: Firefly III allows webhooks HTML Injection.](https://junglewise.ai/threats/cve-2024-22075-firefly-iii-allows-webhooks-html-injection) (low, CVSS 3.1, published 5 Jan 2024) - [CVE-2023-1788: Firefly III insufficiently expires sessions](https://junglewise.ai/threats/cve-2023-1788-firefly-iii-insufficiently-expires-sessions) (low, CVSS 3.1, published 5 Apr 2023) - [CVE-2023-1789: Firefly III vulnerable to improper input validation](https://junglewise.ai/threats/cve-2023-1789-firefly-iii-vulnerable-to-improper-input-validation) (low, CVSS 3.1, published 1 Apr 2023) - [CVE-2023-0298: Improper Authorization in grumpydictator/firefly-iii](https://junglewise.ai/threats/cve-2023-0298-improper-authorization-in-grumpydictator-firefly-iii) (low, CVSS 3.1, published 14 Jan 2023) - [CVE-2021-3846: Unrestricted File Upload vulnerability in Firefly III](https://junglewise.ai/threats/cve-2021-3846-unrestricted-file-upload-vulnerability-in-firefly-iii) (low, CVSS 3.1, published 24 May 2022) - [CVE-2019-13647: Firefly III vulnerable to image-based stored XSS](https://junglewise.ai/threats/cve-2019-13647-firefly-iii-vulnerable-to-image-based-stored-xss) (low, CVSS 3, published 24 May 2022) - [CVE-2019-13646: Firefly III vulnerable to reflected cross-site scripting](https://junglewise.ai/threats/cve-2019-13646-firefly-iii-vulnerable-to-reflected-cross-site-scripting) (low, CVSS 3, published 24 May 2022) - [CVE-2019-13645: Firefly III vulnerable to stored XSS](https://junglewise.ai/threats/cve-2019-13645-firefly-iii-vulnerable-to-stored-xss) (low, CVSS 3, published 24 May 2022) - [CVE-2019-13644: Firefly III vulnerable to stored XSS](https://junglewise.ai/threats/cve-2019-13644-firefly-iii-vulnerable-to-stored-xss) (low, CVSS 3.1, published 24 May 2022) - [CVE-2021-4005: Cross Site Request Forgery in firefly-iii](https://junglewise.ai/threats/cve-2021-4005-cross-site-request-forgery-in-firefly-iii) (low, CVSS 3.1, published 10 Dec 2021) - [CVE-2021-4015: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)](https://junglewise.ai/threats/cve-2021-4015-firefly-iii-is-vulnerable-to-cross-site-request-forgery-csrf) (low, CVSS 3.1, published 6 Dec 2021) - [CVE-2021-3921: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)](https://junglewise.ai/threats/cve-2021-3921-firefly-iii-is-vulnerable-to-cross-site-request-forgery-csrf) (low, CVSS 3, published 15 Nov 2021) - [CVE-2021-3900: Cross-Site Request Forgery in firefly-iii](https://junglewise.ai/threats/cve-2021-3900-cross-site-request-forgery-in-firefly-iii) (low, CVSS 3.1, published 28 Oct 2021) - [CVE-2021-3901: Cross-Site Request Forgery in firefly-iii](https://junglewise.ai/threats/cve-2021-3901-cross-site-request-forgery-in-firefly-iii) (low, CVSS 3, published 28 Oct 2021) - [CVE-2021-3851: Open Redirect in firefly-iii](https://junglewise.ai/threats/cve-2021-3851-open-redirect-in-firefly-iii) (low, CVSS 3, published 21 Oct 2021) - [CVE-2021-3819: Cross-Site Request Forgery in firefly-iii](https://junglewise.ai/threats/cve-2021-3819-cross-site-request-forgery-in-firefly-iii) (low, CVSS 3, published 29 Sep 2021) - [CVE-2019-14671: Improper Input Validation in Firefly III](https://junglewise.ai/threats/cve-2019-14671-improper-input-validation-in-firefly-iii) (low, CVSS 3, published 8 Sep 2021) - [CVE-2021-3728: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)](https://junglewise.ai/threats/cve-2021-3728-firefly-iii-is-vulnerable-to-cross-site-request-forgery-csrf) (low, CVSS 3, published 25 Aug 2021) - [CVE-2021-3730: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)](https://junglewise.ai/threats/cve-2021-3730-firefly-iii-is-vulnerable-to-cross-site-request-forgery-csrf) (low, CVSS 3, published 25 Aug 2021) - [CVE-2021-3729: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)](https://junglewise.ai/threats/cve-2021-3729-firefly-iii-is-vulnerable-to-cross-site-request-forgery-csrf) (low, CVSS 3, published 25 Aug 2021) ## Most severe grumpydictator/firefly-iii (Packagist) vulnerabilities - [CVE-2026-50886: Project Firefly III SSRF in webhook management component](https://junglewise.ai/threats/cve-2026-50886-project-firefly-iii-ssrf-in-webhook-management-component) (critical, CVSS 9.1, published 15 Jun 2026) - [Firefly III Stored XSS in Audit Log Entry via piggy bank name](https://junglewise.ai/threats/firefly-iii-stored-xss-in-audit-log-entry-via-piggy-bank-name-79c37ea2) (medium, CVSS 5.1, published 12 Jun 2026) - [Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)](https://junglewise.ai/threats/firefly-iii-user-api-endpoints-expose-all-users-information-to-any-28231c21) (medium, CVSS 4, published 7 Mar 2026) - [CVE-2021-3846: Unrestricted File Upload vulnerability in Firefly III](https://junglewise.ai/threats/cve-2021-3846-unrestricted-file-upload-vulnerability-in-firefly-iii) (low, CVSS 3.1, published 24 May 2022) - [CVE-2019-13644: Firefly III vulnerable to stored XSS](https://junglewise.ai/threats/cve-2019-13644-firefly-iii-vulnerable-to-stored-xss) (low, CVSS 3.1, published 24 May 2022) - [CVE-2023-0298: Improper Authorization in grumpydictator/firefly-iii](https://junglewise.ai/threats/cve-2023-0298-improper-authorization-in-grumpydictator-firefly-iii) (low, CVSS 3.1, published 14 Jan 2023) - [CVE-2024-37893: Firefly III has a MFA bypass in oauth flow](https://junglewise.ai/threats/cve-2024-37893-firefly-iii-has-a-mfa-bypass-in-oauth-flow) (low, CVSS 3.1, published 17 Jun 2024) - [CVE-2021-3900: Cross-Site Request Forgery in firefly-iii](https://junglewise.ai/threats/cve-2021-3900-cross-site-request-forgery-in-firefly-iii) (low, CVSS 3.1, published 28 Oct 2021) - [CVE-2023-1788: Firefly III insufficiently expires sessions](https://junglewise.ai/threats/cve-2023-1788-firefly-iii-insufficiently-expires-sessions) (low, CVSS 3.1, published 5 Apr 2023) - [CVE-2021-4015: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)](https://junglewise.ai/threats/cve-2021-4015-firefly-iii-is-vulnerable-to-cross-site-request-forgery-csrf) (low, CVSS 3.1, published 6 Dec 2021) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist technologies - [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities - [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities - [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities - [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities - [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities - [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities - [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities - [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities - [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities - [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities - [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities - [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "grumpydictator/firefly-iii (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/grumpydictator-firefly-iii, 9 November 2026.