CVE-2026-91133

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-91133
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91133.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-91133
Aliases
  • GHSA-8hxh-573g-52gx
Published
2026-09-24T16:53:00Z
Modified
2026-09-26T03:48:38Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure
Details

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifier. The affected upload metadata, URL-lookup, and cooked-video-placeholder paths could resolve uploads the user was not authorized to access. This allowed disclosure of restricted metadata, including original filenames and secure-upload paths, without modifying the upload records. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-943"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91133.json"
}
References

Affected packages

Git / github.com/discourse/discourse

Affected ranges

Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
ded677e00beb0e9bae6e70b69582aecfb72b5477
Introduced
06d03da34c4ed09ea59f917f045ba250d2b6320d
Introduced
322d3c0ac6a8f133b3f82875e9dbbe310f638c1b
Fixed
fb9247e04a826ab8e4d91168b3c4c839ec40bccc
Fixed
3ab62a8397926ed934b667a5db06284c45b4c774
Fixed
777cb880553b517bc9ae502e935a160332e48b78
Fixed
e808d0853e013abf90e648e53ebd606c49ccb19f
Fixed
113c34d433d564bc69642649d501251a7e820b52
Fixed
20c48bef712ee3edd4f7af58ca1123cb0c16ef6f
Fixed
a04cab107a9f57939456181c4b082d0a34ec39bd
Fixed
cb3ca8420fcc7aba334effd011cf41943a336fa6
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2026.8.0"
        },
        {
            "introduced":  "2026.7.0-latest"
        },
        {
            "fixed":  "2026.7.2"
        },
        {
            "introduced":  "2026.6.0-latest"
        },
        {
            "fixed":  "2026.6.3"
        },
        {
            "introduced":  "2026.1.0-latest"
        },
        {
            "fixed":  "2026.1.8"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

Other
_gh-attach-assets
esr
stable
v2026.*
v2026.1.0
v2026.1.0-latest
v2026.1.1
v2026.1.2
v2026.1.3
v2026.1.4
v2026.1.5
v2026.1.6
v2026.1.7
v2026.6.0
v2026.6.0-latest
v2026.6.1
v2026.6.2
v2026.7.0
v2026.7.0-latest
v2026.7.1
v2026.8.0-latest
v2026.8.0-latest.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91133.json"