CVE-2026-55420: Discourse: Remote code execution via pdf uploads

Q: What is the severity of CVE-2026-55420?

CVE-2026-55420 has a severity rating of 7.5, categorized as high.

Q: How do I fix CVE-2026-55420?

To mitigate CVE-2026-55420, upgrade Discourse to version 2026.6.0 or later.

Q: What type of vulnerability is CVE-2026-55420?

CVE-2026-55420 is an OS Command Injection vulnerability that allows remote code execution.

Q: What impact can CVE-2026-55420 have on my system?

Exploitation of CVE-2026-55420 can lead to remote code execution on the server, posing significant security risks.

Q: Where can I find more information about CVE-2026-55420?

Information about CVE-2026-55420, including mitigation steps and updates, can be found in Discourse's security advisories.

Published Jul 9, 2026

Updated

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of PDF uploads could be exploited to obtain RCE on the server. This issue is patched in 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Affected Software

5 affected components

Discourse Discourse>, >, >, >

Discourse Discourse>=2026.1.0<2026.1.5

Discourse Discourse>=2026.4.0<2026.4.2

Discourse Discourse>=2026.5.0<2026.5.1

Discourse Discourse=2026.6.0

Remediation

Patch Available

https://github.com/discourse/discourse/commit/ca5a7e06167561928556afa2f237d67e459c6914

Event History

Jul 9, 2026

CVE Published

via MITRE·05:54 PM

Data Sourced

via MITRE·05:54 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Apr 24, 58501

Event

via NVD·03:44 AM

Frequently Asked Questions

What is the severity of CVE-2026-55420?

CVE-2026-55420 has a severity rating of 7.5, categorized as high.

How do I fix CVE-2026-55420?

To mitigate CVE-2026-55420, upgrade Discourse to version 2026.6.0 or later.

What type of vulnerability is CVE-2026-55420?