All vulnerabilities
CVE-2026-91123GHSA-6pwj-wgg8-4rjc

Discourse: Reject literal backslash path separators in iframe src traversal guard

discourse discourseApplications & CMS
Open in ThreatlineRecord JSON
CVSS
7.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2026.8.0Also 2026.7.2, 2026.6.3 and 1 moreGitHub
Published24 Sep 2026Updated 24 Sep 2026CVE List

What fixes it

  • 2026.8.0Discourse, otherGitHub
  • 2026.7.2Discourse, otherGitHub
  • 2026.6.3Discourse, otherGitHub
  • 2026.1.8Discourse, otherGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

Text from CVE List

Affected versions 8

  • discourseaffected: < 2026.8.0CVE List
  • discourseaffected: >= 2026.7.0-latest, < 2026.7.2CVE List
  • discourseaffected: >= 2026.6.0-latest, < 2026.6.3CVE List
  • discourseaffected: >= 2026.1.0-latest, < 2026.1.8CVE List
  • Discourse, other>= 0GitHub
  • Discourse, other>= 2026.7.0-latestGitHub
  • Discourse, other>= 2026.6.0-latestGitHub
  • Discourse, other>= 2026.1.0-latestGitHub

References 6