TI-2022-20279 Aliases CVE-2022-41938 GHSA-7x4w-j98p-854x

Cross site scripting vulnerability with discussion titles in flarum

MEDIUM 42CWE-79Published 2022-11-19 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Flarum is an open source discussion platform. Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after `v1.5` and was not noticed. This allowed an attacker to inject malicious HTML markup using a discussion title input, either by creating a new discussion or renaming one. The XSS attack occurs after a visitor opens the relevant discussion page. All communities running Flarum from `v1.5.0` to `v1.6.1` are impacted. The vulnerability has been fixed and published as flarum/core `v1.6.2`. All communities running Flarum from `v1.5.0` to `v1.6.1` have to upgrade as soon as possible to v1.6.2. There are no known workarounds for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00753 55th percentileScored 2026-11-07

Fix Fixed framework (flarum): 1.6.2flarum/core (Packagist): 1.6.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
flarum	framework	1.5.0 to before 1.6.2	1.6.2	Patch available	CNA
—	flarum/core (Packagist)	1.5.0 to before 1.6.2	1.6.2	Patch available	GHSA-7x4w-j98p-854x

framework Vendorflarum Affected 1.5.0 to before 1.6.2 Fixed in 1.6.2 Patch available CNA
flarum/core (Packagist) Vendor— Affected 1.5.0 to before 1.6.2 Fixed in 1.6.2 Patch available GHSA-7x4w-j98p-854x

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:flarum:flarum::::::::	1.5.0 to before 1.6.2	Vulnerable	flarum

cpe:2.3:a:flarum:flarum:*:*:*:*:*:*:*:* Versions 1.5.0 to before 1.6.2 Vulnerable ·flarum

Remediation

Fix · CNA framework (flarum) Fixed in 1.6.2
Fix · GHSA-7x4w-j98p-854x flarum/core (Packagist) Fixed in 1.6.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-41938
2026-10-03 Alias added: GHSA-7x4w-j98p-854x

References

Patch 1

https://github.com/flarum/framework/commit/690de9ce0ffe7ac4d45b73e303f44340c3433138

Advisory 3

Other 1

https://github.com/flarum/framework

TI-2021-12339 XSS vulnerability with translator CVSS 3.1CRITICAL 10.0
TI-2023-08736 Post mentions can be used to read any post on the forum without access control CVSS 3.1HIGH 7.7
TI-2025-20573 Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite CVSS 3.1MEDIUM 6.8
TI-2019-09878 Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings. CVSS 3.0HIGH 8.8
TI-2019-08604 User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens. CVSS 3.0HIGH 7.5
TI-2023-20923 Server-Side Request Forgery via Avatar upload in flarum CVSS 3.1HIGH 7.1

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences