Executive brief
Discourse, a popular open-source discussion and forum platform, is vulnerable to a security flaw that allows attackers to take control of the server. By uploading a specially crafted PDF file, an attacker can execute malicious commands on the underlying system. This could lead to a total compromise of the forum, including the theft of user data or a complete service shutdown. The vulnerability only affects systems with specific non-default configurations.
Technical details
Discourse is vulnerable to an OS command injection (CWE-78) vulnerability during the processing of PDF uploads. The issue stems from insufficient neutralization of special elements when shelling out to ImageMagick or Ghostscript for PDF-to-image processing. An authenticated attacker with network access can exploit this by uploading a malicious PDF, provided the forum is using a non-default configuration that enables PDF processing. Successful exploitation results in Remote Code Execution (RCE) with the privileges of the Discourse application. The fix involves hardening ImageMagick execution by implementing a default-deny security policy and removing experimental PDF-to-image logic. Patches are available in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Affected products
- Discourse Discourse < 2026.1.5, < 2026.4.2, < 2026.5.1, < 2026.6.0
Timeline
- 2026-06-30: patched: Security hardening commit and releases published.
- 2026-07-09: disclosed: CVE-2026-55420 published.
References
- https://github.com/discourse/discourse/commit/ca5a7e06167561928556afa2f237d67e459c6914
- https://github.com/discourse/discourse/releases/tag/v2026.1.5
- https://github.com/discourse/discourse/releases/tag/v2026.4.2
- https://github.com/discourse/discourse/releases/tag/v2026.5.1
- https://github.com/discourse/discourse/releases/tag/v2026.6.0
- https://github.com/discourse/discourse/security/advisories/GHSA-7wq5-jgww-5rw3