Executive brief
Discourse is an open-source platform used for hosting community discussion forums. A security flaw in how the software handles uploaded images and user profile pictures could allow an attacker to execute malicious scripts in another user's browser. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information if they visit specific, non-standard links within the community.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Discourse due to insufficient sanitization of SVG files during upload and avatar processing. The root cause is the failure to correctly strip internal DTD (Document Type Definition) entities, which can be used to embed malicious scripts. An authenticated attacker can upload a specially crafted SVG file; if a victim visits a specific URL associated with that upload, the script executes in the context of the victim's browser. This issue is mitigated in patched versions by improving SVG sanitization and implementing 'Content-Disposition: attachment' headers for SVG responses as a defense-in-depth measure. Fixes are available in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Affected products
- Discourse Discourse < 2026.1.5, < 2026.4.2, < 2026.5.1, < 2026.6.0
Timeline
- 2026-07-09: disclosed
- 2026-07-09: advisory
References
- https://github.com/discourse/discourse/commit/3ee8343cd7f00d59d8513bee0a12e02d50bfc358
- https://github.com/discourse/discourse/commit/810c2715799fd08b06fd6ffc664d9562fe9ea6ff
- https://github.com/discourse/discourse/commit/92a699d89b84685b6fdd63cd0d0e371793c69dad
- https://github.com/discourse/discourse/commit/b8ceb49f4ba52257be30eb3c2ce51a5bf03be5fe
- https://github.com/discourse/discourse/releases/tag/v2026.1.5
- https://github.com/discourse/discourse/releases/tag/v2026.4.2
- https://github.com/discourse/discourse/releases/tag/v2026.5.1