Executive brief
Discourse is an open-source platform used for hosting online discussion forums and communities. A security flaw in how the software handles backups allows an administrator of one forum to access the private backup files of other forums hosted on the same server. This could lead to the exposure of sensitive community data, including user information and private discussions, to unauthorized administrators.
Technical details
A path traversal vulnerability (CWE-22) exists in the backup download functionality of Discourse when configured for multisite deployments using local storage. An attacker with administrative privileges on one site (Site A) can craft a malicious backup download request containing traversal sequences (e.g., '../') to escape their designated directory and retrieve backup archives belonging to a different site (Site B) on the same host. This vulnerability specifically affects configurations where 'backup_location' is set to 'local'; deployments using S3 storage are not impacted. The issue has been addressed in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.
Affected products
- Discourse Discourse 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, 2026.4.0-latest to before 2026.4.1
Timeline
- 2026-05-18: advisory: GitHub advisory published by maintainers
- 2026-06-12: disclosed: NVD publication date