CVE-2026-91123: Discourse: Reject literal backslash path separators in iframe src traversal guard
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowediframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.8.0
Event History
Frequently Asked Questions
Which deployments are affected?
Discourse deployments running versions earlier than 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0 are affected. The issue is relevant where iframe source URLs are checked against an allowed_iframes subpath restriction.
What does an attacker need to exploit this issue?
An attacker needs to supply a crafted iframe source URL containing decoded dot segments and literal backslashes. The crafted URL must pass the allowed_iframes subpath check, after which browser URL normalization can resolve it outside the administrator-approved path.
What is the impact of successful exploitation?
A successful exploit can cause an iframe to load content from a location outside the intended allowed path. The vulnerability has network attack vector, requires no privileges or user interaction, and can affect confidentiality and integrity.
How can the issue be remediated?
Upgrade Discourse to 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0, depending on the release line in use. These versions reject literal backslash path separators in the affected traversal guard.