Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path.
The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Характеристики атаки
Способ атаки
По сети
Атака возможна удалённо
Сложность
Низкая
Легко эксплуатировать
Нужны права
Не требуются
Права не нужны
Участие пользователя
Не требуется
Не нужно действие пользователя
Последствия
Конфиденциальность
Низкое
Частичная утечка данных
Целостность
Низкое
Частичная модификация данных
Доступность
Нет
Нет нарушения работы
Строка CVSS v3.1
Тип уязвимости (CWE)
Уязвимые продукты
discourse:discourse
Ссылки 6
https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc
https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc
https://github.com/discourse/discourse/pull/42882
https://github.com/discourse/discourse/pull/42882
https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d…
https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318
https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab268…
https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24
https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435…
https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be
https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03d…
https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579