Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

flarum/flarum-core

              2.x @ 4d4987e
            

Fixes

CVEs

CRITICAL

Peak severity

41.7%

Coverage

Highlights

Denial of Service: 3 prior fixes. Scrutinize any change in this area.

src/Api/Resource/UserResource.php: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: Fetching external avatars can allow attackers to perform Server-Side Request Forgery. Robust network limits such as disabling redirects, enforcing strict request timeouts, and limiting content length must be consistently applied to prevent internal network scanning.

SSRF: LESS compiling configurations can allow administrative users to execute path traversal and arbitrary local file reads. Insufficient validation on custom LESS directives lets attackers bypass import rules and read sensitive host files.

Auth Bypass: Weaknesses in password token validation and session destruction processes allow attackers to reuse expired tokens or maintain active sessions after password resets. Tokens must be forcefully invalidated and cleared during critical state modifications.