Flarum's patch for a previous vulnerability (CVE-2023-27577) restricted the use of @import and data-uri() in the custom_less setting but failed to apply the same restrictions to other LESS config variables such as theme_primary_color and theme_secondary_color. These variables are interpolated directly into the LESS source at compile time, allowing an authenticated administrator to inject arbitrary @import directives. Because the LESS parser processes these imports, an attacker can perform local file inclusion or server-side request forgery. The vulnerability affects Flarum framework versions before 1.8.16 and certain 2.0.0 pre-release versions and was fixed in 1.8.16 and 2.0.0-rc.1.

An authenticated administrator can exploit this vulnerability to read arbitrary files accessible to the PHP process or cause the server to make outbound HTTP(S) requests. This can lead to disclosure of sensitive information from the server's file system or interaction with external systems via server-side request forgery. The vulnerability does not impact integrity or availability directly but has a high confidentiality impact.

This vulnerability has been patched in Flarum versions 1.8.16 and 2.0.0-rc.1. Users should upgrade to these or later versions to remediate the issue. No vendor advisory was provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the version information in the description.