CVE-2026-30913: 
PHP vulnerability analysis and mitigation

CVE-2026-30913 is a display name injection vulnerability in the Flarum flarum/nicknames extension that enables registered users to craft nicknames interpreted as hyperlinks by email clients, facilitating phishing attacks via platform notification emails. It affects all versions of flarum/nicknames prior to 1.8.3 on the 1.x branch, and has been present since the extension's initial release. The vulnerability was published on March 8, 2026, and assigned a CVSS v3.1 base score of 4.6 (Medium) (Github Advisory, Flarum Security Advisory).

The root cause is insufficient input validation in the flarum/nicknames extension's display name driver (CWE-79). Unlike the default username driver — which restricts values to [a-zA-Z0-9_-]+ — the nicknames extension applies only configurable min/max length and an optional admin regex, permitting arbitrary characters including those meaningful in URL and markdown contexts. Two exploitation variants exist: Variant 1 (Domain Autolink) — a nickname such as nasty.com is automatically converted to a clickable hyperlink by virtually all email clients (Gmail, Outlook, Apple Mail, Thunderbird) when inserted verbatim into plain-text notification emails; Variant 2 (Markdown Link Syntax) — a nickname such as [CLICK](https://evil.com) is rendered as a clickable link by email clients that auto-render markdown (e.g., Apple Mail, Thunderbird). The nickname is inserted without sanitization into outgoing notification email bodies, making any notification-triggering action (e.g., following or mentioning another user) a delivery mechanism (Flarum Security Advisory, Github Advisory).

Successful exploitation enables social engineering and phishing attacks: recipients of Flarum notification emails may be deceived into clicking attacker-controlled URLs that appear to originate from a trusted forum platform. This can lead to credential harvesting, malware distribution, or other malicious outcomes, resulting in low confidentiality and integrity impacts (no availability impact). Variant 1 is exploitable against virtually all email clients without any special preconditions, broadening the potential victim pool to all users who receive notifications from an affected Flarum instance (Github Advisory, Flarum Security Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires low privileges (a registered forum account) and user interaction (the victim must click the link in the email). The EPSS score is approximately 0.029–0.039%, placing it in the 12th percentile for exploitation likelihood. The CVE status is listed as "Deferred" and it is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Register or use an existing account: Obtain a registered user account on a Flarum forum instance with the flarum/nicknames extension enabled (versions < 1.8.3).
2. Set a malicious nickname (Variant 1 — Autolink): Navigate to account settings and set the nickname to a domain-like string, e.g., attacker-controlled.com. This requires the forum to permit nickname editing (permission user.editOwnNickname).
3. Set a malicious nickname (Variant 2 — Markdown): Alternatively, set the nickname to a markdown link string such as [Click Here](https://attacker-controlled.com) to target email clients that render markdown (e.g., Apple Mail, Thunderbird).
4. Trigger a notification email to a target user: Perform an action that generates a notification email to the victim, such as following them, mentioning them in a post, or replying to their thread.
5. Victim receives phishing email: The victim receives a legitimate-looking Flarum notification email containing the attacker's nickname rendered as a clickable hyperlink, appearing to originate from the trusted forum platform.
6. Credential harvesting or malware delivery: If the victim clicks the link, they are directed to the attacker-controlled domain, where credentials can be harvested or malware distributed (Flarum Security Advisory, Github Advisory).

• Logs: Flarum application logs showing a user account setting a nickname containing dots (e.g., attacker.com) or markdown link syntax characters ([, ], (, )) prior to triggering notification emails.
• User Data: Forum user records with nicknames matching patterns such as *.com, *.net, *.org, or containing [text](url) markdown syntax — detectable via database query on the users table for the nickname field.
• Email Headers/Content: Outbound notification emails from the Flarum mail server containing display names with domain-like strings or markdown link syntax in the email body; review mail server logs for unusual From display name values.
• Network: Unexpected outbound connections from forum users' browsers to external domains shortly after receiving Flarum notification emails, potentially indicating successful phishing link clicks.

Upgrade the flarum/nicknames Composer package to version 1.8.3 or later, which introduces two mitigations: (1) save-time validation that rejects nicknames containing []()<> characters, and (2) a sanitizing decorator applied during email send that strips markdown/HTML link characters and inserts zero-width spaces after dots to break domain autolink recognition (Flarum Security Advisory, Patch Commit). For organizations unable to patch immediately, disable the flarum/nicknames extension until the update can be applied — the default username driver is not affected as it restricts values to [a-zA-Z0-9_-]+. Additionally, educate forum users to verify URLs before clicking links in notification emails.

The vulnerability was discovered and reported via Intigriti's bug bounty program (submission SBB-L4ZVAFH8) by researcher imorland, who also authored the fix. Remediation was verified by DavideIadeluca. The advisory was published by the Flarum maintainers on March 8, 2026, and reviewed by the GitHub Advisory Database on March 10, 2026. No significant broader media coverage or notable community controversy has been identified beyond the standard advisory publication (Flarum Security Advisory, Github Advisory).