CVE-2025-48053

Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, sending a malicious URL in a PM to a bot user can cause a reduced the availability of a Discourse instance. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. No known workarounds are available.

• CWE-400
• CWE-770

• https://github.com/discourse/discourse/security/advisories/GHSA-3q5q-qmrm-rvwxVendor Advisory

Published

Jun 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-48045An unauthenticated HTTP GET request to the /client.php endpo…8.7
• CVE-2025-48046An authenticated user can disclose the cleartext password of…5.3
• CVE-2025-48047An authenticated user can perform command injection via unsa…9.4
• CVE-2025-4805A stored cross-site scripting (XSS) vulnerability exists in …4.8
• CVE-2025-48050In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js…7.5
• CVE-2025-48051powertip.ts in Lila (for Lichess) before ab0beaf allows XSS …6.1
• CVE-2025-48054Radashi is a TypeScript utility toolkit. Prior to version 12…6.8
• CVE-2025-48055Combodo iTop is a web based IT service management tool. In v…5.4
• CVE-2025-48056Hubble is a fully distributed networking and security observ…5.3
• CVE-2025-48057Icinga 2 is a monitoring system which checks the availabilit…9.8
• CVE-2025-48058PowSyBl (Power System Blocks) is a framework to build power …6.3
• CVE-2025-48059PowSyBl (Power System Blocks) is a framework to build power …2.7