Discourse iframe src traversal guard bypass (2026.8.0)
CVE-2026-91123 Published on September 24, 2026
Discourse: Reject literal backslash path separators in iframe src traversal guard
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Vulnerability Analysis
CVE-2026-91123 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is a Directory traversal Vulnerability?
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVE-2026-91123 has been classified to as a Directory traversal vulnerability or weakness.
Products Associated with CVE-2026-91123
Want to know whenever a new CVE is published for Discourse? stack.watch will email you.
Affected Versions
discourse:- Version < 2026.8.0 is affected.
- Version >= 2026.7.0-latest, < 2026.7.2 is affected.
- Version >= 2026.6.0-latest, < 2026.6.3 is affected.
- Version >= 2026.1.0-latest, < 2026.1.8 is affected.