Flarum CVE-2026-41887

The attacker must be an authenticated administrator with permission to modify theme settings via the POST /api/settings API endpoint. No special forum configuration is required; theme color settings and custom LESS config variables are enabled by default in Flarum installations. The vulnerability affects any setting registered as a LESS config variable through Extend\Settings::registerLessConfigVar(), including the built-in theme_primary_color and theme_secondary_color. The attack does not require user interaction and the injected @import directive is processed automatically during CSS compilation on the next settings save or forum rebuild. The LESS parser must honor @import (inline) syntax for exploitation to succeed, which is standard LESS behavior. Authentication requirement: administrator-level privilege (PR:H per CVSS vector). Exploitation is limited to administrators and does not affect unauthenticated users or lower-privilege forum members.

CVSS 4.9 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N indicates network-accessible exploitation requiring high-privilege authentication (admin) with high confidentiality impact but no integrity or availability impact. The seemingly low CVSS score of 4.9 understates real-world risk because it reflects the requirement for admin credentials, yet this is a privilege-escalation vulnerability: an administrator is not intended to have host-level file read access or internal network reach. The exploitation conditions are concrete and verifiable: only authenticated administrators can submit the malicious settings via POST /api/settings, and the attack is deterministic (AC:L). The lack of user interaction (UI:N) and narrow scope (S:U) are accurate. However, the impact is severe in practice because successful exploitation exposes .env files with database credentials, OAuth secrets, API keys, and enables SSRF to AWS IMDSv1 and internal services. No KEV or public POC is referenced in the input data, but the vulnerability is well-documented with a working example payload (theme_primary_color: '#4D698E;@import (inline) /etc/passwd;'), demonstrating immediate and straightforward exploitation. Risk priority depends on forum administrator account security posture; if admin accounts are compromised or if untrusted users hold admin roles, exploitation is highly likely.

A threat actor with valid administrator credentials (either compromised account or malicious insider) submits a POST request to /api/settings with a crafted theme_primary_color value containing @import (inline) '/etc/passwd'; or similar file path. Flarum stores the malicious setting, interpolates it into LESS source on the next CSS compile, and the LESS parser executes the @import directive. The target file's contents are embedded into the compiled forum.css, which is publicly served to all users. The attacker retrieves forum.css and extracts sensitive data (credentials, API keys, environment variables) or uses @import to trigger SSRF requests to internal services and cloud metadata endpoints.