https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 08:45:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-242736 EUVD-2026-242736 https://cve.radiocsirt.org/vuln/euvd-2026-242736 https://cve.radiocsirt.org/vuln/fkie_cve-2024-21641 <p>Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum `/logout` route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation. The vulnerability has been fixed and published as flarum/core v1.8.5. As a workaround, some extensions modifying the logout route can remedy this issue if their implementation is safe.</p> <p>Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum `/logout` route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation. The vulnerability has been fixed and published as flarum/core v1.8.5. As a workaround, some extensions modifying the logout route can remedy this issue if their implementation is safe.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-21641 https://cve.radiocsirt.org/vuln/ghsa-733r-8xcp-w9mr <p><strong>Affected:</strong> Packagist: flarum/core, Packagist: flarum/framework</p> <p>### Impact The Flarum `/logout` route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. Sample: `example.com/logout?return=https://google.com`. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation.</p> <p>Some ecosystem extensions modifying the logout route have already been affected. Sample: https://discuss.flarum.org/d/22229-premium-wordpress-integration/526</p> <p>### Patches The vulnerability has been fixed and published as flarum/core v1.8.5. All communities running Flarum should upgrade as soon as possible to v1.8.5 using:</p> <p>`composer update --prefer-dist --no-dev -a -W`</p> <p>You can then confirm you run the latest version using:</p> <p>`composer show flarum/core`</p> <p>### Workarounds Some extensions modifying the logout route can remedy this issue if their implementation is safe. In any case we recommend updating to 1.8.5.</p> <p>### References For any questions or comments on this vulnerability, please visit https://discuss.flarum.org/</p> <p>For support questions, create a discussion at https://discuss.flarum.org/t/support.</p> <p>A reminder that if you ever become aware of a security issue in Flarum, please report it to us privately by emailing [security@flarum.org](mailto:security@flarum.org), and we will address it promptly.</p> <p><strong>Affected:</strong> Packagist: flarum/core, Packagist: flarum/framework</p> <p>### Impact The Flarum `/logout` route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. Sample: `example.com/logout?return=https://google.com`. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation.</p> <p>Some ecosystem extensions modifying the logout route have already been affected. Sample: https://discuss.flarum.org/d/22229-premium-wordpress-integration/526</p> <p>### Patches The vulnerability has been fixed and published as flarum/core v1.8.5. All communities running Flarum should upgrade as soon as possible to v1.8.5 using:</p> <p>`composer update --prefer-dist --no-dev -a -W`</p> <p>You can then confirm you run the latest version using:</p> <p>`composer show flarum/core`</p> <p>### Workarounds Some extensions modifying the logout route can remedy this issue if their implementation is safe. In any case we recommend updating to 1.8.5.</p> <p>### References For any questions or comments on this vulnerability, please visit https://discuss.flarum.org/</p> <p>For support questions, create a discussion at https://discuss.flarum.org/t/support.</p> <p>A reminder that if you ever become aware of a security issue in Flarum, please report it to us privately by emailing [security@flarum.org](mailto:security@flarum.org), and we will address it promptly.</p> https://cve.radiocsirt.org/vuln/ghsa-733r-8xcp-w9mr https://cve.radiocsirt.org/vuln/gsd-2024-21641 gsd-2024-21641 https://cve.radiocsirt.org/vuln/gsd-2024-21641