Security vulnerabilities in the Discourse platform that allowed file theft have been fixed
A Discourse image upload flaw allowed baseline users to read server files. Researchers disclosed the issue alongside a cache poisoning vulnerability, leading to CVE-2026-55420 patches. According to researchers at Se
A Discourse image upload flaw allowed baseline users to read server files.
Researchers disclosed the issue alongside a cache poisoning vulnerability, leading to CVE-2026-55420 patches.
According to researchers at Searchlight Cyber, the problem lay in the way the service handled images uploaded by users, such as profile pictures. Even a simple user with the lowest level of access could affect the situation.
How were the files read?
The process relied on the fact that image processing programs disagreed with each other about what exactly a file was. By combining different types of files and interfering with the timing of the data being checked, the researchers were able to fool the system.
In tests they conducted, they used a file that represented something other than what it was, eventually managing to read local files and save them in image format so they could download them.
In addition to the image issue, a separate issue was identified involving the way temporary data was stored. This could theoretically allow orders to be executed by visitors who were not logged into the platform at all.
The company's reaction
The researchers notified Discourse officials in June 2026, and the problems were fixed before the research was made public.
The updates that fix the vulnerabilities, which are collectively listed under the identifier CVE-2026-55420, are 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Originally published by Dev.to WebDev. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.