CVE-2023-27577
published 2023-03-10CVE-2023-27577: flarum is a forum software package for building communities. In versions prior to 1.7.0 an admin account which has already been compromised by an attacker may…
PriorityP426medium4.9CVSS 3.1
AVNACLPRHUINSUCHINAN
EPSS
0.85%
53.6th percentile
flarum is a forum software package for building communities. In versions prior to 1.7.0 an admin account which has already been compromised by an attacker may use a vulnerability in the `LESS` parser which can be exploited to read sensitive files on the server through the use of path traversal techniques. An attacker can achieve this by providing an absolute path to a sensitive file in the custom `LESS` setting, which the `LESS` parser will then read. For example, an attacker could use the following code to read the contents of the `/etc/passwd` file on a linux machine. The scope of what files are vulnerable will depend on the permissions given to the running flarum process. The vulnerability has been addressed in version `1.7`. Users should upgrade to this version to mitigate the vulnerability. Users unable to upgrade may mitigate the vulnerability by ensuring that their admin accounts are secured with strong passwords and follow other best practices for account security. Additionally, users can limit the exposure of sensitive files on the server by implementing appropriate file permissions and access controls at the operating system level.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| flarum | core | >= 0 < 1.7.0 | 1.7.0 |
| flarum | core | >= 0 < 1.8.16 | 1.8.16 |
| flarum | core | >= 2.0.0-beta.1 < 2.0.0-rc.1 | 2.0.0-rc.1 |
| flarum | flarum | < 1.7.0 | 1.7.0 |
| flarum | framework | < 1.8.16 | 1.8.16 |
| flarum | framework | — | — |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
ghsa4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)
ghsa·2026-04-22·CVSS 4.9
CVE-2023-27577 [MEDIUM] CWE-22 Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)
Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)
## Summary
Flarum's patch for [CVE-2023-27577](https://github.com/flarum/framework/security/advisories/GHSA-vhm8-wwrf-3gcw) restricted the `@import` and `data-uri()` LESS features in the `custom_less` setting, but the same restriction was never applied to other settings registered as LESS config variables (for example `theme_primary_color` and `theme_secondary_color`, as well as any key registered via `Extend\Settings::registerLessConfigVar()`).
Those values are interpolated verbatim into the LESS source at compile time, allowing an authenticated administrator to craft a theme-color value that injects an arbitrary `@import` directive into the compiled `forum.css`. Because the underlying LE
GHSA
Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files
ghsa·2023-03-13
CVE-2023-27577 [MEDIUM] CWE-22 Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files
Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files
### Impact
If an admin account has already been compromised by an attacker, the `LESS` parser can be exploited to read sensitive files on the server through the use of path traversal techniques.
An attacker can achieve this by providing an absolute path to a sensitive file in the custom `LESS` setting, which the `LESS` parser will then read. For example, an attacker could use the following code to read the contents of the `/etc/passwd` file:
```less
@import (inline) '/etc/passwd';
.test {
content: data-uri('/etc/passwd');
}
```
### Patches
The vulnerability has been addressed in version `1.7`. Users should upgrade to this version to mitigate the vulnerability.
### Workarounds
Users can mitigate the
OSV
Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files
osv·2023-03-13
CVE-2023-27577 [MEDIUM] Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files
Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files
### Impact
If an admin account has already been compromised by an attacker, the `LESS` parser can be exploited to read sensitive files on the server through the use of path traversal techniques.
An attacker can achieve this by providing an absolute path to a sensitive file in the custom `LESS` setting, which the `LESS` parser will then read. For example, an attacker could use the following code to read the contents of the `/etc/passwd` file:
```less
@import (inline) '/etc/passwd';
.test {
content: data-uri('/etc/passwd');
}
```
### Patches
The vulnerability has been addressed in version `1.7`. Users should upgrade to this version to mitigate the vulnerability.
### Workarounds
Users can mitigate the
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/flarum/framework/commit/1761660c98ea5a3e9665fb8e6041d1f2ee62a444https://github.com/flarum/framework/security/advisories/GHSA-vhm8-wwrf-3gcwhttps://github.com/flarum/framework/commit/1761660c98ea5a3e9665fb8e6041d1f2ee62a444https://github.com/flarum/framework/security/advisories/GHSA-vhm8-wwrf-3gcw
2023-03-10
Published