UNIX symbolic link following in Discourse - #VU165857
Published: November 11, 2026
Vulnerability identifier: #VU165857
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-61
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to read and write files outside the restore directory as the user running Discourse, potentially executing code on the server.
The vulnerability exists due to symbolic link following in the Discourse backup restore functionality when restoring uploaded archives with allow_restore enabled. A remote privileged user can restore a crafted backup containing symbolic links to access files outside the restore directory.
Affected software
Discourse
Remediation
Install security update from vendor's website.
Discourse - addressed in versions 2026.7.5, 2026.9.2, 2026.10.1