CVE-2022-36066

Name: CVE-2022-36066
Creator: NVD / NIST
Published: 2022-09-29T20:15:09.747+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.2/10EPSS 1.57%

Last modified Jun 17, 2026

CVE-2022-36066 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary locations and trigger remote code execution. EPSS estimates a 1.57% chance of exploitation in the next 30 days.

Description

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary locations and trigger remote code execution. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.

Metrics

CVSS 3.1

7.2/10

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

1.57%

72.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-434

Affected Software

Vendor	Product	Versions	Update
Discourse	Discourse	< 2.8.9	—
Discourse	Discourse	2.9.0	Beta1

References

https://github.com/discourse/discourse/commit/b27d5626d208a22c516a0adfda7554b67b493835Patch, Third Party Advisory
https://github.com/discourse/discourse/pull/18421Patch, Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-grvh-qcpg-hfmvThird Party Advisory
https://github.com/discourse/discourse/commit/b27d5626d208a22c516a0adfda7554b67b493835Patch, Third Party Advisory
https://github.com/discourse/discourse/pull/18421Patch, Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-grvh-qcpg-hfmvThird Party Advisory

Timeline

Published: Sep 29, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-36066?

How severe is CVE-2022-36066?

CVE-2022-36066 has a CVSS score of 7.2/10 (HIGH severity). The EPSS model estimates a 1.57% probability of exploitation in the next 30 days.

How do I fix CVE-2022-36066?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-36066?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST