---
id: CVE-2026-91121
title: Discourse is an open-source discussion platform
summary: >-
  Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3,
  2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat
  message excerpts were rendered as unescaped HTML. A user able to upload a file
  and se…
severity: medium
cvss: 5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N'
cwe:
  - CWE-79
vendor: discourse
product: discourse
affected:
  - discourse < 2026.8.0
  - 'discourse >= 2026.7.0-latest, < 2026.7.2'
  - 'discourse >= 2026.6.0-latest, < 2026.6.3'
  - 'discourse >= 2026.1.0-latest, < 2026.1.8'
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T18:19:06.720'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91121'
references:
  - url: >-
      https://github.com/discourse/discourse/commit/24cd7cc4c868f20e6037d67d801d60c3e289b278
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/commit/6e7a181909c34a059d2b0a6291335a363205b787
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/commit/9d6f5e64a1cb68e8208520e4209b361e14f7394b
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/commit/af197941f7613a3845cba21d217641c77c8ef836
    label: security-advisories@github.com
  - url: 'https://github.com/discourse/discourse/pull/42882'
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/security/advisories/GHSA-34rh-wjfv-65gq
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-24T17:27:35.450393Z'
ingestedAt: '2026-09-24T17:48:30.402Z'
epss: 0.00258
epssPercentile: 0.15624
---

## Overview

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was then interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. The issue allowed trusted-HTML injection that altered rendered excerpt content, but JavaScript execution was not demonstrated with default Content Security Policy settings. The advisory states that no confidentiality, integrity, or availability impact was identified, while its structured scoring metadata separately assigns low integrity impact. Sites that disable or relax the default CSP have increased exposure. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.