Discourse EUVD-2026-42731

Two specific conditions must both be true for exploitation: (1) the Discourse instance must have the secure_uploads site setting explicitly enabled - this is not the default configuration and must be deliberately activated by an administrator; and (2) the attacker must already know or have obtained the specific secured upload URL for the target file, as the attack does not enumerate or discover files independently. Limiting factors include: the prerequisite of URL knowledge significantly reduces opportunistic exploitation; the attack requires the targeted Discourse instance to be processing posts (the pull_hotlinked_images job must be active); and confidentiality impact is restricted to the specific files whose URLs are already compromised. There is no requirement for authentication to trigger the hotlink pull based on the CVSS PR:N vector, but an actor capable of creating or manipulating posts (even as a regular forum member) is the expected attacker profile.

The CVSS 4.0 base score of 6.3 with vector AV:N/AC:H/AT:P/PR:N/UI:N/VC:L reflects a moderate but conditional risk. The AC:H and AT:P metrics are the critical moderating factors: exploitation requires the attacker to already possess the specific secure upload URL, which represents a significant prerequisite since the secure_uploads feature is specifically designed to prevent URL-based access. VC:L (low confidentiality impact to the vulnerable system) is consistent with the scoped nature of the disclosure - only files whose URLs are already known are at risk. No EPSS score was provided in the input data; prevalence of exploitation cannot be estimated from available signals. This vulnerability is not in CISA KEV. No POC code has been identified. The real-world risk is therefore conditional: instances where secure_uploads is enabled and where secure URLs may have leaked via logs, notification emails, chat exports, or insider access are genuinely at risk, while instances where URL secrecy is maintained are not. This is a real security gap for high-sensitivity deployments (e.g., healthcare, legal, confidential document sharing via Discourse), but not a broad opportunistic exploitation scenario.

An attacker who has obtained a Discourse secure upload URL - for example, from a leaked notification email, a shared post export, server-side logs, or insider access - embeds that URL as an image hotlink in a new post on an affected Discourse instance. When the pull_hotlinked_images background job processes the post, it fetches the content at the secure URL without enforcing the secure_uploads access controls, effectively pulling the protected file into a context where it is exposed. No POC code is publicly available at time of analysis, but the fix commits are public and could allow reconstruction of the vulnerability.