Junglewise Threat Intelligence

CVE-2026-55420: Discourse RCE via PDF upload processing

CVE-2026-55420 · Severity: high · CVSS 7.5 · Published 2026-07-09

Technologies: Discourse. Vendors: Discourse.

Executive brief

Discourse, a popular open-source discussion and forum platform, is vulnerable to a security flaw that allows attackers to take control of the server. By uploading a specially crafted PDF file, an attacker can execute malicious commands on the underlying system. This could lead to a total compromise of the forum, including the theft of user data or a complete service shutdown. The vulnerability only affects systems with specific non-default configurations.

Technical details

Discourse is vulnerable to an OS command injection (CWE-78) vulnerability during the processing of PDF uploads. The issue stems from insufficient neutralization of special elements when shelling out to ImageMagick or Ghostscript for PDF-to-image processing. An authenticated attacker with network access can exploit this by uploading a malicious PDF, provided the forum is using a non-default configuration that enables PDF processing. Successful exploitation results in Remote Code Execution (RCE) with the privileges of the Discourse application. The fix involves hardening ImageMagick execution by implementing a default-deny security policy and removing experimental PDF-to-image logic. Patches are available in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Affected products

  • Discourse Discourse < 2026.1.5, < 2026.4.2, < 2026.5.1, < 2026.6.0

Timeline

  • 2026-06-30: patched: Security hardening commit and releases published.
  • 2026-07-09: disclosed: CVE-2026-55420 published.

References

Related threats