CVE-2026-45788: Discourse: Secure uploads exposed by hotlinked image copying
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, secure uploads could be exposed by pullhotlinkedimages when an attacker knew the secured upload URL and the secureuploads site setting was enabled. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.6.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.4.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.1.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45788?
CVE-2026-45788 has a medium severity rating with a CVSS score of 6.3.
How do I fix CVE-2026-45788?
To fix CVE-2026-45788, upgrade Discourse to version 2026.6.0 or later.
What type of vulnerability is CVE-2026-45788?
CVE-2026-45788 is classified as an information leakage vulnerability.
What could an attacker gain from exploiting CVE-2026-45788?
An attacker could potentially access secure uploads if they knew the secured upload URL.
Is CVE-2026-45788 relevant to all versions of Discourse?
CVE-2026-45788 affects Discourse versions prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.