Description
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
discourse discourse
< 2026.8.0affected>= 2026.7.0-latest, < 2026.7.2affected>= 2026.6.0-latest, < 2026.6.3affected>= 2026.1.0-latest, < 2026.1.8affected
References
- https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc ↗
- https://github.com/discourse/discourse/pull/42882 ↗
- https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318 ↗
- https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24 ↗
- https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be ↗
- https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579 ↗