CVE-2026-91123

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-91123
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91123.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-91123
Aliases
  • GHSA-6pwj-wgg8-4rjc
Published
2026-09-24T16:54:59Z
Modified
2026-09-26T03:47:49Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Discourse: Reject literal backslash path separators in iframe src traversal guard
Details

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91123.json"
}
References

Affected packages

Git / github.com/discourse/discourse

Affected ranges

Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
ded677e00beb0e9bae6e70b69582aecfb72b5477
Introduced
06d03da34c4ed09ea59f917f045ba250d2b6320d
Introduced
322d3c0ac6a8f133b3f82875e9dbbe310f638c1b
Fixed
fb9247e04a826ab8e4d91168b3c4c839ec40bccc
Fixed
3ab62a8397926ed934b667a5db06284c45b4c774
Fixed
777cb880553b517bc9ae502e935a160332e48b78
Fixed
e808d0853e013abf90e648e53ebd606c49ccb19f
Fixed
042d7b159beda4f74d23e245e8b2e396d9ff8318
Fixed
097ce5600a2d74d9c68e57974597ab2684bd2a24
Fixed
0b5a27e689925edce9ba9b14110022435d2b94be
Fixed
142f5155ad8e56ddb8012c4e70c69a03dedc0579
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2026.8.0"
        },
        {
            "introduced":  "2026.7.0-latest"
        },
        {
            "fixed":  "2026.7.2"
        },
        {
            "introduced":  "2026.6.0-latest"
        },
        {
            "fixed":  "2026.6.3"
        },
        {
            "introduced":  "2026.1.0-latest"
        },
        {
            "fixed":  "2026.1.8"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

Other
_gh-attach-assets
esr
stable
v2026.*
v2026.1.0
v2026.1.0-latest
v2026.1.1
v2026.1.2
v2026.1.3
v2026.1.4
v2026.1.5
v2026.1.6
v2026.1.7
v2026.6.0
v2026.6.0-latest
v2026.6.1
v2026.6.2
v2026.7.0
v2026.7.0-latest
v2026.7.1
v2026.8.0-latest
v2026.8.0-latest.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91123.json"