Code Execution Vulnerability in Discourse Open Source Discussion Platform

CVE-2025-66488

What is CVE-2025-66488?

A vulnerability exists in earlier versions of the Discourse platform, impacting users who utilize S3 for upload functionalities. The flaw allows for the execution of scripts, although it's confined to the S3/CDN domain without access to site credentials. To safeguard against potential risks, it is recommended that site owners disable uploads of HTML and XML files through authorized extensions. Additionally, for any existing HTML or XML uploads, it may be prudent to remove them to enhance security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References