CVE-2022-36066criticalCWE-434

CVE-2022-36066: critical vulnerability in discourse

Discourse vulnerable to RCE via admins uploading maliciously zipped file

Published · Updated

Follow this CVE+ Monitor discourse

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 2.1%
In short

Discourse administrators can upload specially crafted ZIP or Gzip Tar files that allow writing files anywhere on the server and executing arbitrary code. This is a critical vulnerability that gives attackers with admin access complete control over the system.

Technical detail

CWE-434 arbitrary file upload vulnerability in Discourse versions prior to 2.8.9 (stable) and 2.9.0.beta10 (beta/tests-passed). Admin users can upload maliciously crafted compressed archives to write files at arbitrary filesystem locations, leading to remote code execution. The vulnerability requires admin privileges but lacks validation of archive contents during extraction.

Summary generated and translated by AI from the official description.
Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary locations and trigger remote code execution. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
discourse · discourse
Related CVEs — discourse

In the same product, most dangerous first.

CVE-2024-53991HIGHPotential Backup file leaked via Nginx in DiscourseEPSS 29.9%CVE-2021-41163CRITICALRCE via malicious SNS subscription payloadEPSS 19.8%CVE-2023-45131HIGHUnauthenticated access to new private chat messages in DiscourseEPSS 4.0%CVE-2026-28227LOWDiscourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_categoryEPSS 3.2%CVE-2024-47773HIGHAnonymous cache poisoning via XHR requests in DiscourseEPSS 1.8%CVE-2021-41082HIGHPrivate message title and participating users leaked in discourseEPSS 1.8%