p PatchFirst

CVE-2026-30913

CVE-2026-30913 · flarum/nickname: Display name injection in notification emails (autolink & markdown)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.

CVSS 4.6 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • nicknames

    Versions
    • < 1.8.3: Affected

    No fix published

  • flarum/nicknames Packagist

    Versions
    • 0.1.0-beta.16.1
    • v0.1.0-beta.15
    • v0.1.0-beta.16
    • v1.0.0
    • v1.1.0
    • v1.2.0
    • v1.3.0
    • v1.3.1
    • v1.4.0
    • v1.5.0
    • v1.6.0
    • v1.6.1
    • v1.7.0
    • v1.8.0
    • v1.8.1
    • v1.8.2
    Affected ranges
    • ECOSYSTEM: < 1.8.3

    Update to 1.8.3

Original sources

Check your server →