CyberRota Analysis
AI-GeneratedThe iframe src traversal guard in Discourse versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 is vulnerable to a path traversal attack due to improper handling of backslashes in decoded dot segments. This flaw allows an attacker to bypass allowed_iframes checks, potentially loading unauthorized content within iframes, which could compromise the integrity of the discussion platform. Administrators using affected versions should prioritize updating to the patched releases to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.