What is the CVSS score of CVE-2025-22601?

CVE-2025-22601 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Discourse are affected by CVE-2025-22601?

CVE-2025-22601 is a low-severity vulnerability in affected involving path traversal (CVSS 3.1).

How to fix or mitigate CVE-2025-22601?

During next maintenance window: Apply vendor patches when convenient. Verify path traversal controls are in place.

Discourse CVE-2025-22601

LOW

Path Traversal (CWE-22)

2025-02-04 security-advisories@github.com

Path Traversal Discourse

3.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:24 vuln.today

CVE Published

Feb 04, 2025 - 21:15 nvd

LOW 3.1

DescriptionGitHub Advisory

Discourse is an open source platform for community discussion. In affected versions an attacker can trick a target user to make changes to their own username via carefully crafted link using the activate-account route. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

AnalysisAI

Discourse is an open source platform for community discussion. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. Discourse is an open source platform for community discussion. In affected versions an attacker can trick a target user to make changes to their own username via carefully crafted link using the activate-account route. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability. Affected products include: Discourse.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.