CVE-2022-41938 json
Cross site scripting vulnerability with discussion titles in flarum
published 2022-11-19 3 y ago modified 2026-06-17 4 mo ago also GHSA-7x4w-j98p-854x , EUVD-2022-7273
- cvss
- 9.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
Flarum is an open source discussion platform. Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after `v1.5` and was not noticed. This allowed an attacker to inject malicious HTML markup using a discussion title input, either by creating a new discussion or renaming one. The XSS attack occurs after a visitor opens the relevant discussion page. All communities running Flarum from `v1.5.0` to `v1.6.1` are impacted. The vulnerability has been fixed and published as flarum/core `v1.6.2`. All communities running Flarum from `v1.5.0` to `v1.6.1` have to upgrade as soon as possible to v1.6.2. There are no known workarounds for this issue.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
0.75% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | flarum/core | >=1.5.0, <1.6.2 |
1.6.2 |
Affected products
- flarum framework
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/flarum/framework/commit/690de9ce0ffe7ac4d45b73e303f44340c3433138
web, patch, third-party-advisory
-
discuss.flarum.org
/d/27558
web, vendor-advisory
-
github.com
/flarum/framework/security/advisories/GHSA-7x4w-j98p-854x
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-41938
advisory
-
github.com
/flarum/framework
package
Sources
- CVE List CVE-2022-41938
- GitHub Advisory GHSA-7x4w-j98p-854x
- NVD CVE-2022-41938
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.