CVE-2026-55420: Discourse RCE via PDF upload processing

CVE-2026-55420 · Severity: high · CVSS 7.5 · Published 2026-07-09

Discourse, a popular open-source discussion and forum platform, is vulnerable to a security flaw that allows attackers to take control of the server. By uploading a specially crafted PDF file, an attacker can execute malicious commands on the underlying system. This could lead to a total compromise of the forum, including the theft of user data or a complete service shutdown. The vulnerability only affects systems with specific non-default configurations.

Technologies: Discourse. Vendors: Discourse.

Quick answers

Is CVE-2026-55420 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55420 being exploited in the wild.
How severe is CVE-2026-55420?
High severity, with a CVSS score of 7.5, published 9 July 2026.
Which products and versions are affected?
Discourse < 2026.1.5, < 2026.4.2, < 2026.5.1, < 2026.6.0.
Is there a fix for CVE-2026-55420?
A patch was published on 2026-06-30: Security hardening commit and releases published. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55420 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55420?
Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Discourse is vulnerable to an OS command injection (CWE-78) vulnerability during the processing of PDF uploads. The issue stems from insufficient neutralization of special elements when shelling out to ImageMagick or Ghostscript for PDF-to-image processing. An authenticated attacker with network access can exploit this by uploading a malicious PDF, provided the forum is using a non-default configuration that enables PDF processing. Successful exploitation results in Remote Code Execution (RCE) with the privileges of the Discourse application. The fix involves hardening ImageMagick execution by implementing a default-deny security policy and removing experimental PDF-to-image logic. Patches are available in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Affected products

  • Discourse Discourse < 2026.1.5, < 2026.4.2, < 2026.5.1, < 2026.6.0

Timeline

  • 2026-06-30: patched: Security hardening commit and releases published.
  • 2026-07-09: disclosed: CVE-2026-55420 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.