Path traversal in Discourse - #VU166162
Published: November 13, 2026
Vulnerability identifier: #VU166162
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to read arbitrary server files, including configuration files.
The vulnerability exists due to path traversal in Discourse's S3 upload migration when processing restored backup upload filenames containing newlines. A remote privileged user can restore a crafted backup on an S3-enabled site with allow_restore enabled to cause files outside the uploads directory to be uploaded to the bucket, exposing their contents.
Affected software
Discourse
Remediation
Install security update from vendor's website.
Discourse - addressed in versions 2026.7.5, 2026.9.2, 2026.10.1