What is the CVSS score of CVE-2026-45775?

CVE-2026-45775 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45775?

Yes, a patch is available for CVE-2026-45775. Update the affected software to the latest version immediately.

Discourse CVE-2026-45775

EUVD-2026-36559 MEDIUM

Path Traversal (CWE-22)

2026-06-12 GitHub_M

Path Traversal Discourse

6.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.8 MEDIUM

PR:H confirmed by admin-only access requirement; S:C reflects cross-site trust boundary violation; I:N and A:N as no write or availability impact exists.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 12, 2026 - 22:01 EUVD

Analysis Generated

Jun 12, 2026 - 21:31 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, a path traversal vulnerability in Discourse backup handling could allow an authenticated administrator on one site in a multisite deployment to access backup files belonging to another site when backups are stored locally. In affected configurations, an admin on Site A could potentially retrieve sensitive backup data from Site B (same host, multisite) by crafting a backup download request with a traversal payload. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

AnalysisAI

Path traversal in Discourse's backup download handler allows an authenticated administrator on one site within a multisite deployment to retrieve backup archives belonging to a co-hosted site on the same server. Backup files typically contain full database dumps, private messages, user credentials, and email addresses, making cross-site access a serious trust-boundary violation. No public exploit has been identified and EPSS sits at 0.04% (12th percentile), reflecting the narrow exploitation conditions; vendor-released patches are available across all affected release trains.

Technical ContextAI

Discourse is a Ruby on Rails-based open-source discussion platform that supports multisite deployments, where multiple discrete communities share a single application server and filesystem. The vulnerability maps to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). In multisite mode with local backup storage enabled, each site's backups are placed in a subdirectory on the shared host. The backup download endpoint fails to sanitize traversal sequences (such as '../') in the requested filename parameter, so a crafted request can resolve to a path outside the requesting site's backup directory and into another site's backup subdirectory. The CPE cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:* covers all Discourse application variants across the three affected release trains (2026.1.x, 2026.3.x, 2026.4.x). The flaw is irrelevant when a remote object store such as S3 is used for backup storage, as there is no shared local filesystem path to traverse.

RemediationAI

Upgrade Discourse to version 2026.1.4 (2026.1.x release train), 2026.3.1 (2026.3.x train), 2026.4.1 (2026.4.x train), or 2026.5.0-latest.1 (latest track) as confirmed by the vendor advisory at https://github.com/discourse/discourse/security/advisories/GHSA-5j6v-4x6g-9pg5. These are vendor-released patches and represent the primary remediation. If immediate patching is not feasible, migrating backup storage from local filesystem to a remote object store (e.g., Amazon S3 or compatible) eliminates the local path traversal attack surface entirely, though it introduces an external storage dependency and associated operational costs. As a secondary compensating control, operators can audit and restrict administrator account grants across all sites in the multisite deployment, minimizing the number of principals capable of mounting this attack - note this may impact legitimate administrative workflows. Generic firewall rules do not mitigate this vulnerability because exploitation occurs through authenticated, application-layer HTTP requests.