A flaw in the LESS parser allows an authenticated administrator to inject an @import directive through the theme_primary_color, theme_secondary_color, or other LESS‑config variables. The injected import is processed by the parser, enabling the attacker to read arbitrary files reachable by the PHP process (local file inclusion) or to initiate outbound HTTP(S) requests (server‑side request forgery). This exposes sensitive configuration files and other data to a privileged attacker and creates a vector for data exfiltration or further compromise.

All Flarum 1.x installations older than 1.8.16, and all 2.x releases older than 2.0.0‑rc.1, are affected. The vulnerability also applies to any extensions that register LESS configuration variables via Extend\Settings::registerLessConfigVar(), as these variables are not subjected to the same import restriction.

The CVSS score of 4.9 indicates moderate severity; the vulnerability requires authenticated administrator privileges but imposes no network‑level constraints. EPSS information is unavailable, and the flaw is not listed in CISA’s KEV catalog. Because the attack requires modifying a theme‑color setting, it is likely limited to administrators or privileged users who have access to the Flarum backend. The attack vector, while internal, can still facilitate data theft or pivot to other services by leveraging LFI or SSRF.