CVE-2025-66488: Discourse allows script execution in uploaded HTML/XML files on S3
Discourse is an open source discussion platform. A vulnerability present in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 affects anyone who uses S3 for uploads. While scripts may be executed, they will only be run in the context of the S3/CDN domain, with no site credentials. Versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 fix the issue. As a workaround, disallow html or xml files for uploads in authorizedextensions. For existing html xml uploads, site owners can consider deleting them.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66488?
CVE-2025-66488 is considered a high severity vulnerability due to its potential to allow script execution on uploaded files.
How do I fix CVE-2025-66488?
To fix CVE-2025-66488, upgrade Discourse to version 3.5.4 or later, including 2025.11.2, 2025.12.1, or 2026.1.0.
Who is affected by CVE-2025-66488?
CVE-2025-66488 affects users of Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 that utilize S3 for uploads.
What types of files are involved in CVE-2025-66488?
CVE-2025-66488 involves HTML and XML files uploaded to S3 that could allow script execution.
Can CVE-2025-66488 be exploited remotely?
Yes, CVE-2025-66488 can be exploited remotely by manipulating uploaded files in the affected Discourse versions.