Loading vulnerability…
Remote code execution through PDF upload processing in Discourse
CVE-2026-55420 is a remote code execution vulnerability in Discourse's PDF upload processing under certain non-default configurations. Processing an attacker-controlled PDF upload can result in code execution on the server. Fixed releases are 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5. The specific vulnerable function and underlying weakness are not established.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits remote code execution on the Discourse server. The execution identity, resulting privileges, and extent of access to server resources are not specified. A separately described image-upload chain demonstrated server-file disclosure, but its relationship to this CVE's narrower, non-default PDF configuration scope is not conclusively established.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by disabling or restricting PDF uploads and any server-side PDF processing features that are not strictly required, especially where non-default upload-processing configurations are enabled. Limit who can upload files, isolate document-processing components, and run the application and any helper utilities with minimal privileges to reduce post-exploitation impact. Additional hardening such as sandboxing file-conversion tooling and segregating upload-processing workloads may further reduce risk, but patching is the primary mitigation.
Patch, then assume compromise.
Upgrade to the applicable fixed release: Discourse 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5, or a later release containing the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.