CVE-2026-91133mediumCWE-943

CVE-2026-91133: medium-severity vulnerability in discourse

Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure

Published

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.3%
exploitation probability
0.3%top 81% of all CVEs
observed exploitation
nono source reports it
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifier. The affected upload metadata, URL-lookup, and cooked-video-placeholder paths could resolve uploads the user was not authorized to access. This allowed disclosure of restricted metadata, including original filenames and secure-upload paths, without modifying the upload records. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
discourse · discourse
Related CVEs — discourse

In the same product, most dangerous first.

CVE-2024-53991HIGHPotential Backup file leaked via Nginx in DiscourseEPSS 29.9%CVE-2021-41163CRITICALRCE via malicious SNS subscription payloadEPSS 19.8%CVE-2022-36066CRITICALDiscourse vulnerable to RCE via admins uploading maliciously zipped fileEPSS 2.0%CVE-2023-45131HIGHUnauthenticated access to new private chat messages in DiscourseEPSS 1.8%CVE-2021-41082HIGHPrivate message title and participating users leaked in discourseEPSS 1.8%CVE-2024-47773HIGHAnonymous cache poisoning via XHR requests in DiscourseEPSS 1.7%
References
https://github.com/discourse/discourse/commit/113c34d433d564bc69642649d501251a7e820b52https://github.com/discourse/discourse/commit/20c48bef712ee3edd4f7af58ca1123cb0c16ef6fhttps://github.com/discourse/discourse/commit/a04cab107a9f57939456181c4b082d0a34ec39bdhttps://github.com/discourse/discourse/commit/cb3ca8420fcc7aba334effd011cf41943a336fa6https://github.com/discourse/discourse/pull/42882https://github.com/discourse/discourse/security/advisories/GHSA-8hxh-573g-52gx