Discourse EUVD-2026-86306

Requires an authenticated Discourse account with privileges to (a) upload a file and (b) post chat content, so the Discourse Chat feature must be enabled on the site. The attacker embeds HTML markup in the uploaded file's filename, which is then rendered unescaped by chat excerpt surfaces (channel lists, chat summary emails, pinned message bars, reply previews, thread previews). Exploitation is LIMITED to trusted-HTML injection under the default Content Security Policy - JavaScript execution was not demonstrated; only sites that DISABLE or RELAX the default CSP have increased exposure to script-level attacks. No unauthenticated or user-interaction-free path exists.

This is a genuinely low-priority issue despite a moderate 5.0 CVSS. The vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) requires an authenticated user with upload-and-chat privileges, and the only rated impact is low integrity (I:L) - content/markup alteration of rendered excerpts, not code execution or data theft. Critically, the advisory itself states no confidentiality, integrity, or availability impact was identified, which conflicts with the structured scoring metadata that assigns I:L; this internal contradiction should be noted when triaging. No EPSS score is provided in the input, there is no CISA KEV listing, and no public exploit code was identified - so there is no evidence of active or automated exploitation. The most important limiter is that JavaScript execution was NOT demonstrated under Discourse's default Content Security Policy; exploitation is confined to trusted-HTML injection into excerpts, and only sites that disable or relax the default CSP face elevated (potential scripting) exposure. Net: a real but minor stored-content-injection bug, not a high-urgency threat.

An authenticated user on a trust level permitting file uploads and chat crafts a file whose filename contains HTML markup, then sends chat content referencing it. The malicious filename is rendered unescaped in downstream excerpt surfaces (channel lists, chat summary emails, pinned message bars, reply/thread previews), altering what other users see; under default CSP this is limited to trusted-HTML injection with no demonstrated JavaScript execution. No public proof-of-concept was identified, and impact escalates only on sites running a disabled or relaxed CSP.