Discourse up to 3.4.3/3.5.0.beta4/3.5.0.beta5-dev Email Body topic_title cross site scripting

Summaryinfo

A vulnerability was found in Discourse up to 3.4.3/3.5.0.beta4/3.5.0.beta5-dev and classified as problematic. This issue affects the function topic_title of the component Email Body Handler. The manipulation results in cross site scripting. This vulnerability is known as CVE-2025-48062. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Discourse up to 3.4.3/3.5.0.beta4/3.5.0.beta5-dev. Affected is the function topic_title of the component Email Body Handler. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. This is going to have an impact on integrity. CVE summarizes:

Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, certain invites via email may result in HTML injection in the email body if the topic title includes HTML. This includes inviting someone (without an account) to a PM and inviting someone (without an account) to a topic with a custom message. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. This can be worked around if the relevant templates are overridden without `{topic_title}`.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-48062 since 05/15/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Upgrading to version 3.4.4, 3.5.0.beta5 or 3.5.0.beta6-dev eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-17465). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Chat Software

Name

• Discourse

Version

• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.5.0.beta1
• 3.5.0.beta2
• 3.5.0.beta3
• 3.5.0.beta4
• 3.5.0.beta5-dev

License

• open-source

Website

• Product: https://github.com/discourse/discourse/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion