Is CVE-2026-91123 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91123 being exploited in the wild.

How severe is CVE-2026-91123?

High severity, with a CVSS score of 7.2, published 24 September 2026.

Which products and versions are affected?

Discourse before 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

Is there a fix for CVE-2026-91123?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-91123 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-91123?

Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91123: Discourse iframe src path traversal via backslash bypass

CVE-2026-91123 · Severity: high · CVSS 7.2 · Published 2026-09-24

Discourse, an open-source discussion platform, contains a path validation flaw in its iframe source policy enforcement that allows crafted iframe sources to bypass administrator-configured content restrictions. An attacker could craft a malicious iframe that loads content from unauthorized locations, potentially exposing users to injected content or unauthorized data access depending on what resources the iframe could access.

Technologies: Discourse. Vendors: Discourse.

Quick answers

Is CVE-2026-91123 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91123 being exploited in the wild.
How severe is CVE-2026-91123?: High severity, with a CVSS score of 7.2, published 24 September 2026.
Which products and versions are affected?: Discourse before 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Is there a fix for CVE-2026-91123?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-91123 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-91123?: Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The iframe src traversal guard fails to treat literal backslashes as path separators when validating against allowed_iframes subpath restrictions. An attacker can craft a source containing decoded dot segments and backslashes that passes the validation check but is normalized by the browser to point outside the intended allowed path, resulting in loading content from an unintended location. The vulnerability affects Discourse versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, and has been patched in those releases.

Affected products

Discourse Discourse before 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0

Timeline

2026-09-24: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.