Discourse vulnerable to RCE via admins uploading maliciously zipped file
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.1epss 1.6%
exploitation probability
1.6%top 26% of all CVEs
observed exploitation
nono source reports it
In short
Discourse administrators can upload specially crafted ZIP or Gzip Tar files that allow writing files anywhere on the server and executing arbitrary code. This is a critical vulnerability that gives attackers with admin access complete control over the system.
Technical detail
CWE-434 arbitrary file upload vulnerability in Discourse versions prior to 2.8.9 (stable) and 2.9.0.beta10 (beta/tests-passed). Admin users can upload maliciously crafted compressed archives to write files at arbitrary filesystem locations, leading to remote code execution. The vulnerability requires admin privileges but lacks validation of archive contents during extraction.
Summary generated and translated by AI from the official description.
Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary locations and trigger remote code execution. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
discourse · discourse