flarum/core
Healthy and suitable to use. It has long-term release activity, an active organization-backed repository with 210 recent commits from 12 maintainers, clear licensing, tests, and a security policy; the main caveat is that repository security scanning was not detected.
88%
Total Score
100
100
94
100
Health Score Breakdown
Composer build tooling is present, but no repository security-scanning tools were detected. The missing scanning evidence is a transparency and maintenance-process gap, though it is not severe enough to make the release unsafe to adopt on its own.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2026-41887 flarum/core is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 1.8.15 and 2.0.0-beta.1 - 2.0.0-beta.8. | 0.0.0 - 1.8.152.0.0-beta.1 - 2.0.0-beta.8 | Medium |
CVE-2025-27794 flarum/core is vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in versions 0.0.0 - 1.8.10. | 0.0.0 - 1.8.10 | Medium |
CVE-2024-21641 flarum/core is vulnerable to URL Redirection to Untrusted Site ('Open Redirect') in versions 0.0.0 - 1.8.5. | 0.0.0 - 1.8.5 | Medium |
CVE-2023-40033 flarum/core is vulnerable to Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in versions 0.0.0 - 1.8.0. | 0.0.0 - 1.8.0 | High |
CVE-2023-27577 flarum/core is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 1.7.0. | 0.0.0 - 1.7.0 | Medium |
Package versions
Maintainers
 Franz Liedke |
| Daniël Klabbers |
| David Sevilla Martin |
| Clark Winkelmann |
| Matthew Kilgore |
| Alexander (Sasha) Skvortsov |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 symfony/yaml Version ^4.3.4 | — | — |
axy/sourcemap Version ^0.1.4 | — | — |
doctrine/dbal Version ^2.7 | — | — |
nesbot/carbon Version ^2.0 | — | — |
illuminate/bus Version ^6.0 | — | — |
Weekly Downloads
Info
- Last Published
- 5 years ago
- Created
- 11 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.