File Upload Exposure in Discourse Open-Source Discussion Platform
CVE-2026-45788

6.3MEDIUM

Key Information:

Vendor

Discourse
Status
Discourse
Vendor
CVE Published:
9 July 2026

What is CVE-2026-45788?

The Discourse platform exhibits a vulnerability where secure uploads could potentially be exposed due to improper handling in the 'pull_hotlinked_images' functionality. This issue arises when an attacker is aware of the secured upload URL and the secure_uploads site setting is enabled. To mitigate this risk, users should upgrade to the latest versions 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5, where this vulnerability has been addressed.

Affected Version(s)

discourse >= 2026.1.0-latest, < 2026.1.5 < 2026.1.0-latest, 2026.1.5

discourse >= 2026.4.0-latest, < 2026.4.2 < 2026.4.0-latest, 2026.4.2

discourse >= 2026.5.0-latest, < 2026.5.1 < 2026.5.0-latest, 2026.5.1

References

https://github.com/discourse/discourse/security/advisorie...
x_refsource_CONFIRM
https://github.com/discourse/discourse/commit/5807c426880...
x_refsource_MISC
https://github.com/discourse/discourse/commit/8b4a959b251...
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.