Remote Code Execution Vulnerability in Discourse by Insecure PDF Uploads
CVE-2026-55420
7.5HIGH
What is CVE-2026-55420?
Discourse, a widely-used open-source discussion platform, was found to have a vulnerability that allows for remote code execution through improper handling of PDF file uploads in configurations that do not follow default settings. This exploit can compromise server integrity and security, allowing unauthorized access or control. The issue is rectified in the subsequent versions: 2026.1.5, 2026.4.2, 2026.5.1, and 2026.6.0, where users are strongly encouraged to update to these versions to ensure their systems are secure.
Affected Version(s)
discourse >= 2026.5.0-latest, < 2026.5.1 < 2026.5.0-latest, 2026.5.1
discourse >= 2026.4.0-latest, < 2026.4.2 < 2026.4.0-latest, 2026.4.2
discourse >= 2026.1.0-latest, < 2026.1.5 < 2026.1.0-latest, 2026.1.5