CVE-2026-91123
CVE-2026-91123 — Discourse: Reject literal backslash path separators in iframe src traversal guard
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Published Updated Sources: cvelistV5, GitHub_M
Triage
Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.
Exploitation
Unreported
no source claims exploitation
EPSS
0%
chance of exploitation in 30 days
CVSS base
7.2
HIGH
CISA SSVC assessment
Three decision points CISA publishes for the CVEs it assesses · SSVC 2.0.3. A stakeholder decision, not a severity score.
Exploitation
None
none · proof-of-concept · active
Automatable
Yes
can an attacker script all four kill-chain steps
Technical impact
Partial
partial · total control of the vulnerable component
Affected scope
The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.
Vendors (1)
Products (1)
Every base score collected
Sources score independently and disagree; each row says who scored it and under which version.
| Score | Version | Severity | Expl. | Impact | Source |
|---|---|---|---|---|---|
| 7.2 | CVSS 3.1 | HIGH | — | — | cvelistV5 |
Weakness & attack patterns
- CWE-22
References
6 on the record
- github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc
x_refsource_CONFIRM
- github.com/discourse/discourse/pull/42882
x_refsource_MISC
- github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318
x_refsource_MISC
- github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24
x_refsource_MISC
- github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be
x_refsource_MISC
- github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579
x_refsource_MISC
Elsewhere on this site
Not in any source we poll
Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.
- No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
- No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
- No exploit packet captures, log samples, or incident case IDs supplied.