PT-2025-4589 · Discourse · Discourse

Oiiwroo + 1 · Published 2025-02-04 · Updated 2025-09-25 · CVE-2025-22601

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest version

Description Discourse is an open source platform for community discussion. In affected versions, an attacker can trick a target user to make changes to their own username via a carefully crafted link using the activate-account route.

Recommendations For versions prior to the latest version, update to the latest version of Discourse to resolve the issue. As a temporary workaround, consider restricting access to the activate-account route until the update is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-22601

GHSA-GVPP-V7MP-WXXW

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22601.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-22601 · Security Note
• https://osv.dev/vulnerability/CVE-2025-22601 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-gvpp-v7mp-wxxw · Note
• https://twitter.com/VulmonFeeds/status/1887002048266150232 · Twitter Post
• https://twitter.com/CVEnew/status/1886885700794040817 · Twitter Post
• https://t.me/cveNotify/136453 · Telegram Post
• https://t.me/cvedetector/17252 · Telegram Post