All vulnerabilities
CVE-2026-91133GHSA-8hxh-573g-52gx

Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure

discourse discourseApplications & CMS
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published24 Sep 2026Updated 24 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifier. The affected upload metadata, URL-lookup, and cooked-video-placeholder paths could resolve uploads the user was not authorized to access. This allowed disclosure of restricted metadata, including original filenames and secure-upload paths, without modifying the upload records. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

Text from CVE List

Affected versions 4

  • discourseaffected: < 2026.8.0CVE List
  • discourseaffected: >= 2026.7.0-latest, < 2026.7.2CVE List
  • discourseaffected: >= 2026.6.0-latest, < 2026.6.3CVE List
  • discourseaffected: >= 2026.1.0-latest, < 2026.1.8CVE List

References 6