CVE-2023-41042

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, importing a remote theme loads their assets into memory without enforcing limits for file size or number of files. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches. There are no known workarounds.

• CWE-770
• CWE-770

• https://github.com/discourse/discourse/security/advisories/GHSA-2fq5-x3mm-v254Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-2fq5-x3mm-v254Third Party Advisory

Published

Sep 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41037OpenPGP.js is a JavaScript implementation of the OpenPGP pro…4.3
• CVE-2023-41038Firebird is a relational database. Versions 4.0.0 through 4.…7.5
• CVE-2023-41039RestrictedPython is a restricted execution environment for P…7.7
• CVE-2023-4104An invalid Polkit Authentication check and missing authentic…5.5
• CVE-2023-41040GitPython is a python library used to interact with Git repo…6.5
• CVE-2023-41041Graylog is a free and open log management platform. In a mul…3.1
• CVE-2023-41043Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2023-41044Graylog is a free and open log management platform. A partia…3.8
• CVE-2023-41045Graylog is a free and open log management platform. Graylog …5.3
• CVE-2023-41046XWiki Platform is a generic wiki platform offering runtime s…6.3
• CVE-2023-41047OctoPrint is a web interface for 3D printers. OctoPrint vers…6.5
• CVE-2023-41048plone.namedfile allows users to handle `File` and `Image` fi…5.4