Path traversal in Discourse - #VU165855
Published: November 11, 2026
Vulnerability identifier: #VU165855
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to write files outside the temporary directory used for custom emoji export.
The vulnerability exists due to improper pathname restriction in Discourse's custom emoji export when processing emoji names restored from a crafted backup. A remote privileged user can restore a backup containing crafted emoji names on a site with allow_restore enabled and trigger emoji export to write files outside its intended directory.
Affected software
Discourse
Remediation
Install security update from vendor's website.
Discourse - addressed in versions 2026.7.5, 2026.9.2, 2026.10.1