Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path.
The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
discourse:discourse
References 6
https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc
https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc
https://github.com/discourse/discourse/pull/42882
https://github.com/discourse/discourse/pull/42882
https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d…
https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318
https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab268…
https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24
https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435…
https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be
https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03d…
https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579