← Back

CVE-2025-66488

nvd nist
Published: Jan 28, 2026Modified: Jun 17, 2026

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.7
Source: NVD

Description

Discourse is an open source discussion platform. A vulnerability present in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 affects anyone who uses S3 for uploads. While scripts may be executed, they will only be run in the context of the S3/CDN domain, with no site credentials. Versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 fix the issue. As a workaround, disallow html or xml files for uploads in authorized_extensions. For existing html xml uploads, site owners can consider deleting them.

Affected (4)

Products: Discourse: Discourse
Discourse
1 product
Discourse
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Discourse
Discourse
Before 3.5.4
Discourse
From 2025.11.0 to 2025.11.2
Discourse
Version 2025.12.0
Discourse
Version 2026.1.0

Related CWEs

CWE-116
Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

References (1)

Source: security-advisories@github.com
Third Party Advisory

Timeline

No history available yet.