Loading story…
A vulnerability in Flarum tracked as CVE-2023-40033 allows an authenticated user with a basic forum account to supply a malicious avatar URL and read arbitrary local files from the server. The issue stems from Flarum's handling of avatar retrieval and can be exploited as a blind file-content oracle, potentially exposing application configuration, credentials, and other sensitive filesystem data.
The same flaw can be used for blind server-side request forgery (SSRF), enabling requests to internal or otherwise inaccessible network resources through the affected Flarum instance. Flarum fixed the issue in flarum/framework version 1.8.0 and later; organizations should upgrade affected deployments and review logs and configuration exposure for evidence of exploitation.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Flarum addressed CVE-2023-40033 in flarum/framework version 1.8.0 and later.
Assetnote Security Research Team member Adam Kues identified CVE-2023-40033 in Flarum. A basic forum user could supply a malicious avatar URL to read arbitrary local files and conduct blind SSRF attacks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical OS command injection flaw tracked as **CVE-2026-14863** allows remote code execution in **FileRun** through its thumbnail generation workflow. The vulnerability affects FileRun up to and including **2026.2.0** and stems from attacker-controlled filenames being passed to `exec()` inside shell double quotes without proper sanitization such as `escapeshellarg()`. By uploading a file with shell command substitution in its name, such as a payload using `$()`, an authenticated attacker can trigger command execution when FileRun invokes thumbnail tools including **ffmpeg**, **ImageMagick**, **vips**, or **stl-thumb**. The issue is classified as **CWE-78** and carries a **CVSS 3.1** vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`. VulnCheck reported that exploitation is possible for any authenticated user with default upload permissions and, in some deployments, may also be reachable before authentication through public file-request weblinks if an attacker knows the token. The official FileRun Docker image reportedly enables the vulnerable thumbnail extractors by default, increasing exposure for containerized deployments. Successful exploitation can provide code execution as **`www-data`**, potentially exposing all files managed by FileRun, database credentials, and broader access to the host server. **FileRun 2026.2.1** is listed as unaffected and contains the fix.
Aug 14, 2026
Adobe ColdFusion is facing active exploitation of **CVE-2026-48282**, a maximum-severity flaw tied to **RDS arbitrary file write** that can be abused without privileges on unpatched servers. The Canadian Centre for Cyber Security warned that open-source reporting indicates in-the-wild attacks, while Adobe has issued security updates and urged administrators to patch immediately because of the high risk of compromise. Affected releases include **ColdFusion 2025.9, 2023.20, and earlier**, and internet scanning data from Shadowserver shows nearly **800** ColdFusion instances exposed online, though the number still vulnerable is unclear. Separate reporting on **CVE-2026-48276** highlights a closely related ColdFusion attack path in which an unauthenticated attacker uploads a malicious **CFML** payload through an unrestricted file-upload weakness, writes a web shell into a web-accessible location, and then triggers it with an HTTP request to gain code execution. That issue was described as critical with a **CVSS v3.1** score reflecting full impact to confidentiality, integrity, and availability, and its documented root causes included poor filename and extension validation and storing uploads under the web root. Public detection content has also appeared for **CVE-2026-48282**, underscoring defender focus on identifying exposed and unpatched ColdFusion systems.
Jul 12, 2026
XenForo disclosed and patched three high-severity vulnerabilities affecting multiple 2.2 and 2.3 releases, including **remote code execution**, **OAuth2 authorization abuse**, and a **template method call restriction bypass**. The most severe issue, `CVE-2026-35056`, allows an authenticated but malicious administrator with admin control panel access to execute arbitrary code on the server, affecting versions before **2.3.9** and **2.2.18**. The flaw is classified as `CWE-94` and carries a high-impact CVSS vector indicating compromise of confidentiality, integrity, and availability. Two additional XenForo flaws affect authorization controls in the platform. `CVE-2025-71278` impacts versions before **2.3.5** and allows OAuth2 client applications to request unauthorized scopes, potentially granting access beyond intended permissions; it is mapped to `CWE-863`. `CVE-2025-71281` affects versions before **2.3.7** and stems from a loose prefix match in template callback and variable method-call handling, enabling unauthorized method invocation from templates. XenForo addressed the issues in security releases **2.3.5**, **2.3.7**, **2.3.9**, and **2.2.18**, with advisories also published by VulnCheck.
Jun 29, 2026