CVE-2026-91123 in Discourse
Summary
by MITRE • 09/24/2026
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in Discourse prior to the specified patch versions represents a critical path traversal flaw within its iframe embedding mechanism. This security issue stems from an inconsistency between how the server-side validation logic processes URL-encoded dot segments and how web browsers normalize URLs when rendering iframes. Specifically, the guard designed to restrict iframe sources to allowed subpaths failed to correctly interpret literal backslashes as path separators after decoding sequences such as .. or ./. This oversight allows a crafted source attribute in an HTML tag to bypass the server-side allowlist check while simultaneously exploiting browser-specific URL normalization rules that resolve these encoded segments into actual directory traversals.
From a technical perspective, this flaw is classified under CWE-20 Improper Input Validation and more specifically aligns with CWE-75 Path Traversal: Outside Restricted Directory when applied to web contexts. The core of the issue lies in the sanitization routine not accounting for all valid path separator characters recognized by modern browsers during the rendering phase. When a user or an attacker injects a URL containing encoded dot segments followed by backslashes, the server-side validation may perceive the resulting path as remaining within the allowed directory structure because it does not fully resolve these sequences before comparison. However, once the browser processes the iframe source attribute, it normalizes the URL, effectively resolving the traversal and loading content from an arbitrary location outside the permitted scope.
The operational impact of this vulnerability is significant for administrators who rely on Discourse to safely embed external content within their forums or applications. By exploiting this flaw, a malicious actor could load iframes pointing to phishing sites, malware distribution centers, or other untrusted domains that were explicitly blocked by administrative policies. This bypasses the intended security controls designed to prevent mixed-content issues and potential cross-site scripting vectors associated with embedding third-party content. The ability to escape the allowed iframe subpath undermines the integrity of the platform's content policy enforcement mechanisms.
This vulnerability maps directly to MITRE ATT&CK technique T1562 Impair Defenses, specifically through Subversion of Security Features or Disable/Modify Tools, as it allows an attacker to circumvent security controls implemented by the system administrator. It also relates to CWE-829 Inclusion of Functionality from Untrusted Control in certain contexts where external content is loaded without proper validation. The exploitation requires no special privileges beyond being able to post HTML containing iframe tags with crafted src attributes, making it accessible to any user with posting permissions on a vulnerable instance.
To mitigate this risk, organizations running Discourse must immediately upgrade to version 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0, as these releases contain the necessary fixes for the iframe src traversal guard. Until upgrading is possible, administrators should consider implementing strict Content Security Policy headers that restrict frame sources to explicitly whitelisted domains rather than relying solely on path-based validation within the application logic. Additionally, monitoring logs for unusual patterns of HTML injection attempts involving encoded characters and backslashes can help detect potential exploitation activities in real-time.