EUVD-2026-42734Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister low-privilege Discourse account
-
DeliveryUpload crafted SVG with embedded JavaScript payload
-
ExploitIdentify or construct triggering non-standard URL
-
ExecutionLure authenticated victim to triggering URL
-
PersistXSS payload executes in victim browser
-
ImpactExfiltrate session token or perform privileged action
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | An authenticated Discourse account with upload privileges is required (PR:L - any registered forum member qualifies under default configurations). The malicious SVG must be submitted through the upload or avatar handling workflow. The critical limiting condition is that the XSS payload fires only when a victim visits 'specific URLs that are not normally part of community browsing' - the precise URL pattern is not disclosed in the advisory, preventing passive exploitation through normal topic or post navigation. Active user interaction is required (UI:R): the victim must be directed to or independently visit the triggering URL. This non-standard URL requirement is the primary factor limiting mass or automated exploitation relative to a stored XSS that fires on every page view. |
| Impact | The CVSS 5.4 Medium score reflects the constrained but real impact: PR:L confirms any registered user can supply the malicious payload, while UI:R and the advisory's disclosure that the XSS only fires at 'specific URLs not normally part of community browsing' materially bounds opportunistic mass exploitation. An attacker cannot simply post to a discussion thread and passively harvest victims browsing normally. The S:C scope change is the primary risk amplifier - a triggered XSS can exfiltrate session cookies or perform privileged actions on behalf of administrative victims. No EPSS data was provided in the input intelligence; no public exploit code is referenced; and CISA KEV has not listed this vulnerability, all pointing toward low active exploitation pressure at time of analysis. Risk is highest for forums with open registration, untrusted user content, and administrative users who may be directed to uncommon platform URLs. |
| Exploit ScenarioDerived | An attacker registers or uses an existing low-privilege account on a target Discourse instance, uploads a crafted SVG file containing an embedded JavaScript payload as their avatar or a file attachment, then socially engineers an administrator or privileged user into visiting the specific non-standard URL that triggers SVG rendering in-browser. Upon visiting that URL, the victim's browser executes the attacker's JavaScript, potentially exfiltrating session tokens or performing administrative actions on the attacker's behalf. No public proof-of-concept code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 09, 2026
Stored cross-site scripting in Discourse's SVG upload and user avatar handling allows authenticated users to inject malicious JavaScript that executes in victims' browsers when they visit specific non-standard URLs. The CVSS scope change (S:C) reflects that successful exploitation crosses the browser security boundary, enabling session token theft or account takeover against victims who visit the triggering URL. Vendor-confirmed patches are available across four release branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
The primary fix is to upgrade Discourse to one of the vendor-patched releases: v2026.6.0, v2026.5.1, v2026.4.2, or v2026.1.5, all available via the GitHub releases page (https://github.com/discourse/discourse/releases). The underlying fixes are delivered across four commits (3ee8343, 810c271, 92a699d, b8ceb49) and are confirmed by the vendor advisory GHSA-jmcf-3367-78vv. As a compensating control pending upgrade, administrators can remove 'svg' from the allowed upload extensions in Admin Settings under Files → authorized_extensions - this eliminates the SVG attack surface entirely at the cost of disabling SVG avatar and attachment support for all users. No other specific workarounds are documented in the available references.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Discourse is a Ruby on Rails-based open-source forum platform widely self-hosted by communities and organizations. The flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) stems from insufficient sanitization of SVG files submitted through upload and avatar handling workflows. SVG is an XML-based vector format that legally supports embedded JavaScript via inline <script> elements, event handler attributes (onload, onerror, onclick), and javascript: URIs - making it a well-known XSS vector when not properly sanitized before browser rendering. The CVSS vector S:C (scope change) indicates the injected script executes outside the origin of the vulnerable component, consistent with same-origin policy bypass patterns common in avatar/upload serving contexts. Four upstream commits (3ee8343, 810c271, 92a699d, b8ceb49) address the sanitization logic across affected branches.
Know when Discourse gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L because any registered user can upload SVGs; UI:R because victim must navigate to specific non-standard URLs; S:C for cross-origin JavaScript execution in victim's browser context.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
1DescriptionCVE.org
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, insufficient SVG sanitization in upload and user avatar handling could lead to cross-site scripting when a user visited specific URLs that are not normally part of community browsing. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Discourse versions prior to 3.5.0.beta6 contain a reflected cross-site scripting (XSS) vulnerability in social login fun
discourse-bbcode is the official BBCode plugin for Discourse. Rated critical severity (CVSS 9.8), this vulnerability is
Unauthorized information disclosure in Discourse discussion platform versions prior to 2026.3.0-latest.1, 2026.2.1, and
Discourse is an open source platform for community discussion. Rated high severity (CVSS 8.2), this vulnerability is rem
Discourse versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 contain an insecure direct object reference (IDOR) in the
In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms. Rated
Unauthenticated attackers can submit forged webhook payloads to multiple email provider integrations in Discourse versio
Discourse is an open-source discussion platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploi
Discourse is an open source platform for community discussion. Rated medium severity (CVSS 5.9), this vulnerability is r
Discourse versions prior to 3.4.4 (stable), 3.5.0.beta5 (beta), and 3.5.0.beta6-dev (tests-passed) contain a critical vu
Discourse is an open source platform for community discussion. Rated critical severity (CVSS 9.8), this vulnerability is
Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. Rated critical severity (CVSS 9.8
Exploit-DB