Medium, CVSS 4.6PackagistPublished
flarum/nicknames extension has display name injection in notification emails (autolink & markdown)
CVE-2026-30913 · GHSA-3c4m-j3g4-hh25
- Affected
- Packagist flarum/nicknames < 1.8.3
- Fixed in
- 1.8.3· Vendor fix available
- Issue
- When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains. Affected package - flarum/nicknames — permissive display name driver that allows special characters; affected since initial release on the 1.x branch Any third-party display name driver that permits special characters would be equally affected. Variants 1. Domain autolink — a nickname such as nasty.com is automatically converted to a clickable hyperlink by virtually all email clients (Gmail, Outlook, Apple Mail, Thunderbird). 2. Markdown link syntax — a nickname such as CLICK is rendered as a clickable hyperlink by email clients that auto-render markdown in plain-text emails (e.g. Apple Mail, Thunderbird). Steps to reproduce Variant 1 (autolink — affects all email clients) 1. Enable…
Recommended action: Upgrade to 1.8.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.