CVE-2025-66488

Discourse is an open source discussion platform. A vulnerability present in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 affects anyone who uses S3 for uploads. While scripts may be executed, they will only be run in the context of the S3/CDN domain, with no site credentials. Versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 fix the issue. As a workaround, disallow html or xml files for uploads in authorized_extensions. For existing html xml uploads, site owners can consider deleting them.

• CWE-116

• https://github.com/discourse/discourse/security/advisories/GHSA-68jp-3934-62rxThird Party Advisory

Published

Jan 28, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66482Misskey is an open source, federated social media platform. …6.5
• CVE-2025-66483IBM Aspera Shares 1.9.9 through 1.11.0 does not invalidate s…6.5
• CVE-2025-66484IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to stor…5.4
• CVE-2025-66485IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTTP…5.4
• CVE-2025-66486IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTML…6.1
• CVE-2025-66487IBM Aspera Shares 1.9.9 through 1.11.0 does not properly rat…6.5
• CVE-2025-66489Cal.com is open-source scheduling software. Prior to 5.9.8, …9.8
• CVE-2025-6649PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Infor…3.3
• CVE-2025-66490Traefik is an HTTP reverse proxy and load balancer. For vers…6.5
• CVE-2025-66491Traefik is an HTTP reverse proxy and load balancer. Versions…5.9
• CVE-2025-66492Masa CMS is an open source Enterprise Content Management pla…6.1
• CVE-2025-66493A use-after-free vulnerability exists in the AcroForm handli…7.8