PT-2026-56893 · Discourse · Discourse

Publicado 2026-07-09 · Atualizado 2026-07-09 · CVE-2026-55420

Mitre

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of PDF uploads could be exploited to obtain RCE on the server. This issue is patched in 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-55420

Produtos afetados

Discourse

Referências · 7

• https://github.com/discourse/discourse/commit/ca5a7e06167561928556afa2f237d67e459c6914 · Nota
• https://github.com/discourse/discourse/releases/tag/v2026.6.0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-55420 · Nota de Segurança
• https://github.com/discourse/discourse/security/advisories/GHSA-7wq5-jgww-5rw3 · Nota
• https://github.com/discourse/discourse/releases/tag/v2026.5.1 · Nota
• https://github.com/discourse/discourse/releases/tag/v2026.4.2 · Nota
• https://github.com/discourse/discourse/releases/tag/v2026.1.5 · Nota