CVE-2022-41938

Flarum is an open source discussion platform. Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after `v1.5` and was not noticed. This allowed an attacker to inject malicious HTML markup using a discussion title input, either by creating a new discussion or renaming one. The XSS attack occurs after a visitor opens the relevant discussion page. All communities running Flarum from `v1.5.0` to `v1.6.1` are impacted. The vulnerability has been fixed and published as flarum/core `v1.6.2`. All communities running Flarum from `v1.5.0` to `v1.6.1` have to upgrade as soon as possible to v1.6.2. There are no known workarounds for this issue.

• CWE-79

• https://discuss.flarum.org/d/27558Vendor Advisory
• https://github.com/flarum/framework/commit/690de9ce0ffe7ac4d45b73e303f44340c3433138Patch, Third Party Advisory
• https://github.com/flarum/framework/security/advisories/GHSA-7x4w-j98p-854xThird Party Advisory
• https://discuss.flarum.org/d/27558Vendor Advisory
• https://github.com/flarum/framework/commit/690de9ce0ffe7ac4d45b73e303f44340c3433138Patch, Third Party Advisory
• https://github.com/flarum/framework/security/advisories/GHSA-7x4w-j98p-854xThird Party Advisory

Published

Nov 19, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-41932XWiki Platform is a generic wiki platform offering runtime s…5.3
• CVE-2022-41933XWiki Platform is a generic wiki platform offering runtime s…6.5
• CVE-2022-41934XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2022-41935XWiki Platform is a generic wiki platform offering runtime s…4.3
• CVE-2022-41936XWiki Platform is a generic wiki platform offering runtime s…7.5
• CVE-2022-41937XWiki Platform is a generic wiki platform offering runtime s…8.1
• CVE-2022-41939knative.dev/func is is a client library and CLI enabling the…7.4
• CVE-2022-4194Use after free in Accessibility in Google Chrome prior to 10…8.8
• CVE-2022-41940Engine.IO is the implementation of transport-based cross-bro…6.5
• CVE-2022-41941GLPI is a Free Asset and IT Management Software package. Ver…4.8
• CVE-2022-41942Sourcegraph is a code intelligence platform. In versions pri…7.8
• CVE-2022-41943sourcegraph is a code intelligence platform. As a site admin…7.2