Discourse Exploit Chains Enable Server File Access and Persistent XSS

Researchers disclosed two vulnerability chains in Discourse affecting image processing and anonymous-page caching. The image-upload chain allowed a Trust Level 0 user to exploit inconsistent file-format detection across Discourse, ImageMagick and Ghostscript. A padded JPEG widened a file-replacement race to roughly 25 seconds, allowing an attacker to substitute an SVG after validation and invoke Magick Scripting Language. The research demonstrated arbitrary server-file disclosure, described file-write capabilities and identified potential escalation to remote code execution, but did not demonstrate that escalation. The researchers reported that the chain worked in a default configuration; the references do not establish exploitation in the wild.

The separate cache-poisoning chain combined unescaped reflection of the color_scheme_id cookie, its omission from anonymous cache keys and a trusted plugin-loading mechanism that bypassed Content Security Policy. This enabled persistent attacker-controlled JavaScript execution for anonymous visitors. Both issues were reported in June 2026 and patched before publication, according to the subsequent news report. The CVE-2026-55420 advisory lists patched releases 2026.6.0, 2026.5.1, 2026.4.2 and 2026.1.5, but describes non-default PDF configurations rather than the broader image-processing chain reported by researchers. Administrators should upgrade to a supported patched release and verify coverage for both vulnerability chains rather than treating that advisory as a complete description of exposure.