Discourse EUVD-2025-33221

Exploitation requires (1) administrator privileges on at least one site, (2) a multisite Discourse deployment for the cross-site data/credential access that gives this bug its severity, and (3) the ability to supply a crafted database backup containing malicious PostgreSQL meta-commands that get executed when the restore pipeline pipes the dump into psql. The specific affected feature is the backup/restore database restorer (lib/backup_restore/database_restorer.rb) in Discourse 3.5.0 and below. Limiting factors: it is not remote-unauthenticated - it demands a pre-existing admin account (PR:H) and the deliberate act of restoring an attacker-controlled dump; on a single-site install the cross-tenant impact does not apply, so the realistic target population is shared/multisite hosting.

This is a genuine but not urgent issue, and the available signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:H/PR:H/UI:N) and the description agree: exploitation requires an authenticated administrator (PR:H), a high-complexity precondition (AC:H) in the form of a multisite deployment plus a specially crafted backup dump, and it is reachable over the network via the admin restore function. EPSS is 0.03% (10th percentile), the vulnerability is NOT on the CISA KEV list, and no public exploit was identified - all of which align with the modest 5.5 (Medium) base score. The notable nuance is the technical-impact split in the 4.0 vector: impact to the vulnerable system is low (VC:L, VI:N, VA:N) but subsequent-system impact is high across the board (SC:H/SI:H/SA:H) because, in multisite setups, one tenant admin can reach other tenants' data and credentials. In short, this is a legitimate privilege-boundary/tenant-isolation flaw for multisite operators, not a widely-exploitable internet-facing RCE. For single-site Discourse installs the practical risk is minimal (an admin attacking their own site); the real priority is for shared/multisite hosting providers, where the cross-tenant impact matters.

A customer who holds administrator rights on one site of a shared multisite Discourse deployment crafts a database backup file with malicious PostgreSQL meta-commands embedded in it and triggers a restore. During the psql restore the embedded meta-commands execute, letting the attacker read data and credentials belonging to other sites hosted on the same instance. No public exploit code was identified, and the attack requires existing admin access plus the high-complexity multisite condition.