CVE-2026-91123

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

• CWE-22

• https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318
• https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24
• https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be
• https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579
• https://github.com/discourse/discourse/pull/42882
• https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc

Published

Sep 24, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9111Use after free in WebRTC in Google Chrome on Linux prior to …8.8
• CVE-2026-91119Discourse is an open-source discussion platform. Prior to 20…6.4
• CVE-2026-9112Use after free in GPU in Google Chrome on Windows prior to 1…8.8
• CVE-2026-91120Discourse is an open-source discussion platform. Prior to 20…5.4
• CVE-2026-91121Discourse is an open-source discussion platform. Prior to 20…5
• CVE-2026-91122Discourse is an open-source discussion platform. Prior to 20…8.7
• CVE-2026-91127File Viewer is a browser-native viewer for Office, PDF, CAD,…8.2
• CVE-2026-91129Home Assistant is open source home automation software focus…5.4
• CVE-2026-9113Out of bounds read in GPU in Google Chrome on Mac prior to 1…4.3
• CVE-2026-91130Home Assistant is open source home automation software focus…9.3
• CVE-2026-91132Discourse is an open-source discussion platform. Prior to 20…4.3
• CVE-2026-91133Discourse is an open-source discussion platform. Prior to 20…6.5