CVE-2026-91133: Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifier. The affected upload metadata, URL-lookup, and cooked-video-placeholder paths could resolve uploads the user was not authorized to access. This allowed disclosure of restricted metadata, including original filenames and secure-upload paths, without modifying the upload records. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.8 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.6.3 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.7.2 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.8.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Discourse user can exploit it. No user interaction is required, and the issue can disclose upload metadata for uploads that the user is not authorized to access.
What information may be exposed?
The issue can expose restricted upload metadata, including original filenames and secure-upload paths. It does not modify the affected upload records.
Which releases contain fixes?
The issue is fixed in Discourse versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0. Deploy the applicable fixed release for the version line in use.