Executive brief
Discourse, a discussion platform used for community engagement and internal communications, allows users to upload files to chat messages. An attacker who uploads a file with HTML markup in the filename could inject unescaped HTML that appears in chat previews, email summaries, and pinned messages, potentially altering how content is displayed to other users. While the default content security policy prevents JavaScript execution, administrators who have relaxed these protections face greater risk.
Technical details
The vulnerability is a trusted-HTML injection in chat message excerpt rendering caused by failure to escape upload filenames before displaying them in multiple excerpt contexts (channel lists, summary emails, pinned messages, reply/thread previews). An authenticated attacker can upload a file with HTML markup in its filename and trigger rendering through chat features. The fix implements proper escaping via a new upload_filename_excerpt method to sanitize filenames before display.
Affected products
- Discourse Discourse before 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0
Timeline
- 2026-09-24: disclosed
- 2026-08-25: patched: fix committed to repository