CVE-2025-22601: Client Side Path Traversal using activate account route in Discourse
Discourse is an open source platform for community discussion. In affected versions an attacker can trick a target user to make changes to their own username via carefully crafted link using the activate-account route. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22601?
CVE-2025-22601 has been classified as a medium severity vulnerability.
How do I fix CVE-2025-22601?
To fix CVE-2025-22601, update Discourse to the latest patched version.
Who is affected by CVE-2025-22601?
Users of Discourse versions prior to the security patch are affected by CVE-2025-22601.
What type of attack is CVE-2025-22601 associated with?
CVE-2025-22601 is associated with social engineering attacks where an attacker manipulates users to change their own usernames.
What is the impact of CVE-2025-22601?
The impact of CVE-2025-22601 allows an attacker to change a victim's username on the Discourse platform.