What is the CVSS score of CVE-2026-55420?

CVE-2026-55420 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Discourse are affected by CVE-2026-55420?

Discourse's discourse-ai plugin contains a remote code execution vulnerability (CVE-2026-55420, CVSS 8.1) in its PDF processing feature that allows attackers uploading crafted PDFs to execute…. A patch is available.

How to fix or mitigate CVE-2026-55420?

Within 24 hours, inventory all Discourse deployments and determine whether the discourse-ai plugin's LLM vision model features are currently enabled; if enabled, prioritize patching immediately per vendor advisory. Within 7 days, deploy the available vendor patch across all affected Discourse instances running discourse-ai. Within 30 days, complete patch validation on all systems, restrict PDF upload capabilities to authenticated users where operationally feasible, and review PDF upload logs since the vulnerability discovery date for suspicious activity.

Discourse CVE-2026-55420

EUVD-2026-42665 HIGH

OS Command Injection (CWE-78)

2026-07-09 security-advisories@github.com

Command Injection Discourse

8.1

CVSS 3.1 · NVD

Severity by source

Vendor (github) PRIMARY

HIGH

qualitative

NVD

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-delivered upload (AV:N) but requires the non-default discourse-ai PDF/vision config (AC:H) and normally a logged-in uploader (PR:L); delegate RCE yields full host impact (C/I/A:H).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 13, 2026 - 14:45 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jul 13, 2026 - 14:45 vuln.today

Analysis Updated

Jul 13, 2026 - 14:45 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 13, 2026 - 14:37 vuln.today

cvss_changed

CVSS changed

Jul 13, 2026 - 14:37 NVD

7.5 (HIGH) 8.1 (HIGH)

Patch available

Jul 09, 2026 - 19:01 EUVD

Analysis Generated

Jul 09, 2026 - 18:31 vuln.today

DescriptionNVD

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of PDF uploads could be exploited to obtain RCE on the server. This issue is patched in 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

AnalysisAI

Remote code execution in Discourse (via the discourse-ai plugin's PDF-to-text feature) allows an attacker who can upload a crafted PDF to run arbitrary commands on the server, but only in non-default configurations where an LLM vision model is configured. The flaw is a CWE-78 OS command injection reached when uploaded PDFs are rasterized through ImageMagick, which in turn invokes an external delegate (Ghostscript) on attacker-controlled input. It is not in CISA KEV and has no public exploit identified at time of analysis; EPSS is low at 0.33% (25th percentile), and vendor patches exist across all supported release lines.

Technical ContextAI

The vulnerable code lives in plugins/discourse-ai/lib/utils/pdf_to_text.rb, which - when an LLM model is configured (@llm_model set) - shells out to ImageMagick's magick binary with -density 300 on the uploaded PDF path to convert each page to a PNG before OCR/vision extraction. ImageMagick historically dispatches PDF/PostScript handling to an external delegate program (Ghostscript), and crafted PDF/PostScript content can smuggle shell commands through that delegate pipeline, yielding OS command injection (CWE-78), the ImageMagick/Ghostscript 'delegate' RCE class. The CPE data scopes this to cpe:2.3:a:discourse:discourse across multiple release trains, fixed at 2026.6.0. The fix removes the ImageMagick PDF-rasterization path entirely (falling back to plain PDF::Reader text extraction), forces all ImageMagick invocations through a locked-down policy.xml (loaded via MAGICK_CONFIGURE_PATH, enforced by an initializer that refuses to boot if the variable is overridden), disables all external delegates and filters, blocks path/@-indirection tricks, and denies every coder except an explicit allowlist of raster/SVG-dimension formats.

RemediationAI

Vendor-released patch: upgrade to 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5 (whichever matches your release train), per advisory GHSA-7wq5-jgww-5rw3 and the release tags at https://github.com/discourse/discourse/releases; the underlying change is commit ca5a7e06167561928556afa2f237d67e459c6914. If you cannot patch immediately, the most direct compensating control is to disable the discourse-ai PDF-to-text/vision pathway (unset the configured LLM vision model / disable AI PDF processing), which removes the ImageMagick PDF-rasterization call at the cost of losing AI OCR of PDFs. As an environment-level control you can replicate the fix's hardened ImageMagick policy (config/imagemagick/policy.xml) to deny all external delegates (Ghostscript) and restrict coders to the needed formats, and set MAGICK_CONFIGURE_PATH to point at it; the trade-off is that any legitimate feature relying on a now-denied coder or delegate will break, so test image/HEIC/SVG-dimension handling after applying it. Restricting who may upload PDFs (e.g. trust-level gating, disabling anonymous uploads) reduces but does not eliminate exposure.