CVE-2026-91123 Discourse: Reject literal backslash path separators in iframe src traversal guard
Attackers can bypass iframe path restrictions using backslashes to load unauthorized content, requiring administrators to upgrade Discourse.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-91123?
CVE-2026-91123 is a high-severity path traversal vulnerability in discourse, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Weakness: CWE-22
Which versions are affected by CVE-2026-91123?
1 open source package ship an affected version, including discourse.
| Package | Affected | Fixed in |
|---|---|---|
discourse Bitnami | All versions | 2026.8.0 |
How do I fix CVE-2026-91123?
Upgrade discourse to 2026.8.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-91123 being exploited?
There is no known exploitation of CVE-2026-91123 in the wild and no public exploit code.
Sources
Also known as BIT-discourse-2026-91123, GHSA-6pwj-wgg8-4rjc.