Composer grumpydictator/firefly-iii has 26 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2021-3846 | Unrestricted File Upload vulnerability in Firefly III | high | 8.8 | <5.6.2 | 5.6.2 |
| CVE-2019-13644 | Firefly III vulnerable to stored XSS | medium | 5.4 | <4.7.17.1 | 4.7.17.1 |
| CVE-2019-13645 | Firefly III vulnerable to stored XSS | medium | 5.4 | <4.7.17.3 | 4.7.17.3 |
| CVE-2019-13646 | Firefly III vulnerable to reflected cross-site scripting | medium | 5.4 | <4.7.17.3 | 4.7.17.3 |
| CVE-2019-13647 | Firefly III vulnerable to image-based stored XSS | medium | 5.4 | <4.7.17.3 | 4.7.17.3 |
| CVE-2021-3663 | No Restriction of Excessive Authentication Attempts in Firefly III | medium | 5.3 | <5.5.13 | 5.5.13 |
| CVE-2023-0298 | Improper Authorization in grumpydictator/firefly-iii | medium | 6.5 | <5.8.0 | 5.8.0 |
| CVE-2024-37893 | Firefly III has a MFA bypass in oauth flow | medium | 5.9 | <6.1.17 | 6.1.17 |
| CVE-2021-3851 | Open Redirect in firefly-iii | medium | 5.0 | <5.6.2 | 5.6.2 |
| CVE-2021-3901 | Cross-Site Request Forgery in firefly-iii | low | 3.5 | <=5.6.2 | – |
| CVE-2021-3900 | Cross-Site Request Forgery in firefly-iii | medium | 6.5 | <=5.6.2 | – |
| CVE-2021-3819 | Cross-Site Request Forgery in firefly-iii | medium | 4.3 | <5.6.1 | 5.6.1 |
| CVE-2021-3728 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 6.5 | <5.6.0 | 5.6.0 |
| CVE-2021-3730 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 6.5 | <5.6.0 | 5.6.0 |
| CVE-2019-14671 | Improper Input Validation in Firefly III | low | 3.3 | <4.7.17.4 | 4.7.17.4 |
| CVE-2021-3921 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 5.4 | <5.6.3 | 5.6.3 |
| CVE-2021-4005 | Cross Site Request Forgery in firefly-iii | medium | 4.3 | <5.6.5 | 5.6.5 |
| CVE-2021-4015 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 4.3 | <5.6.5 | 5.6.5 |
| CVE-2023-1788 | Firefly III insufficiently expires sessions | medium | 4.2 | <6.0.0 | 6.0.0 |
| CVE-2021-3729 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 4.3 | <5.6.0 | 5.6.0 |
| CVE-2024-22075 | Firefly III allows webhooks HTML Injection. | medium | 6.5 | <6.1.1 | 6.1.1 |
| CVE-2023-1789 | Firefly III vulnerable to improper input validation | medium | 5.9 | <6.0.0 | 6.0.0 |
| CVE-2026-50886 | Project Firefly III has incorrect access control in the webhook management component | critical | 9.1 | <=6.5.9 | – |
| GHSA-29w6-c52g-m8jc | C5 Firefly III CSV Injection. | medium | 4.0 | <6.1.7 | 6.1.7 |
| GHSA-5q8v-j673-m5v4 | Firefly III user API endpoints expose all users' information to any authenticated user (IDOR) | medium | 0.0 | >=6.4.23 and <6.5.1 | 6.5.1 |
| GHSA-6jq6-x4cx-qvcm | Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig) | medium | 0.0 | <6.6.3 | 6.6.3 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked