---
id: CVE-2026-91123
title: Discourse is an open-source discussion platform
summary: >-
  Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3,
  2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal
  backslashes as path separators after decoded dot segments. A crafted source
  could …
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-22
vendor: discourse
product: discourse
affected:
  - discourse < 2026.8.0
  - 'discourse >= 2026.7.0-latest, < 2026.7.2'
  - 'discourse >= 2026.6.0-latest, < 2026.6.3'
  - 'discourse >= 2026.1.0-latest, < 2026.1.8'
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T18:19:06.883'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91123'
references:
  - url: >-
      https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579
    label: security-advisories@github.com
  - url: 'https://github.com/discourse/discourse/pull/42882'
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-24T17:11:25.606443Z'
ingestedAt: '2026-09-24T17:48:30.386Z'
---

## Overview

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.