What’s Vulnerable › Vulnerabilities

CVE-2026-30913: flarum/nickname: Display name injection in notification emails (autolink & markdown)

• Severity: medium (CVSS 4.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-10 · updated 2026-06-17
• Weakness: CWE-79

Description

Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.

Affected products

• flarum nicknames: before 1.8.3

References

• https://github.com/flarum/framework/security/advisories/GHSA-3c4m-j3g4-hh25
• https://github.com/flarum/nicknames/commit/4dde99729abdce8f6e2a7437c86e38735fdcca28
• https://github.com/flarum/nicknames/releases/tag/v1.8.
• https://github.com/flarum/framework/security/advisories/GHSA-3c4m-j3g4-hh25

Get alerted when CVE-2026-30913 or the next vulnerability affects your stack