CyberRota Analysis
AI-GeneratedThe vulnerability affects the Discourse open-source discussion platform, specifically in versions prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, where secure uploads could be compromised via the pull_hotlinked_images feature if an attacker had knowledge of the secured upload URL and the secure_uploads setting was enabled. This could lead to unauthorized access to sensitive uploaded content, posing a significant risk to user data integrity and confidentiality. Organizations using affected versions should prioritize upgrading to the patched releases to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, secure uploads could be exposed by pull_hotlinked_images when an attacker knew the secured upload URL and the secure_uploads site setting was enabled. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Related CVEs
Other vulnerabilities affecting the same vendor(s)