Discourse CVE-2026-55420

Exploitation requires a non-default deployment: the discourse-ai plugin must be installed and enabled with an LLM/vision model configured, since the vulnerable ImageMagick rasterization branch in pdf_to_text.rb only runs when @llm_model is set - plain instances that only extract PDF text never reach it. The attacker must be able to upload a PDF, which on default Discourse requires a registered/logged-in account (authentication requirements not fully confirmed from the PR:N vector, which conflicts with normal upload behavior), and the server's ImageMagick must permit the PDF/PostScript external delegate (Ghostscript) - the exact condition the patched policy.xml removes. Limiting factors: dependency on the optional AI PDF feature, need for upload privileges, and reliance on an ImageMagick/Ghostscript configuration that allows delegate execution; these make the exploitable population a small subset of all Discourse installs.

Signals are mixed and point to a real-but-conditional risk rather than a mass-exploitation event. The CVSS 3.1 score is 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H): network-reachable with full CIA impact, but AC:H reflects the required non-default configuration. EPSS is low (0.33%, 25th percentile) and the vulnerability is not in CISA KEV, with no public exploit identified at time of analysis, so there is no evidence of active or widespread exploitation. The dependency on the discourse-ai plugin plus a configured LLM vision model sharply narrows the exposed population - most Discourse installs do not reach the vulnerable code path. Note a discrepancy worth verifying: the NVD/vendor vector states PR:N (unauthenticated), yet uploading a PDF to Discourse normally requires a logged-in account, so real-world exploitation more likely requires at least a low-privilege registered user (PR:L) unless anonymous/guest uploads are enabled. Net: prioritize patching where discourse-ai PDF processing is enabled, but this is not a drop-everything internet-wide emergency for typical deployments.

On a Discourse instance running discourse-ai with a configured LLM vision model, an attacker with upload rights posts a specially crafted PDF; when the AI pipeline rasterizes it via ImageMagick, the embedded PostScript/delegate payload executes shell commands on the server, giving code execution as the Discourse process. No public exploit is identified at time of analysis, though the ImageMagick/Ghostscript delegate technique is well documented; AC:H reflects that the target must have the non-default AI PDF configuration enabled.