Advisory: Flarum LFI - CVE-2023-40033

Summary An attacker with a basic user forum account can specify a malicious avatar URL that discloses the contents of arbitrary local files on the file system. Impact An attacker can read the contents of any local file. An attacker can also conduct blind SSRF attacks. Affected Software The following versions are affected by this vulnerability: flarum/framework = 1.8.0. Flarum has released an advisory here. The vulnerability was assigned CVE-2023-40033. Blog Post The blog post detailing the steps