Reported by 2 outlets
Discourse ImageMagick Vulnerability Enables Arbitrary File Read Through Malicious Image Uploads
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 1.00 / 2.0 · updates in 48h
- Pickup speed
- 0.35 / 0.6 · time to second source
- Recency
- × 0.45 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 2.1 / 10 = base × recency + community
Analysis
Discourse patched two vulnerabilities tracked as CVE-2026-55674 and CVE-2026-55420. The pair enables cache-poisoning XSS and server-side file reads through malicious image uploads. Impact is significant for self-hosted forums running unpatched releases; attackers can read server files and inject malicious content into cached responses. Only two sources (securityonline.info and gbhackers.com) cover it so far, indicating limited but real exposure.
Upgrade to the fixed release promptly. If running a public or internal Discourse instance, audit image uploads and review logs for unexpected file-access patterns.
Timeline
-
original reporting
Discourse ImageMagick Vulnerability Enables Arbitrary File Read Through Malicious Image Uploads
gbhackers.com · 1d ago · October 12th, 2026
Security researchers have revealed a critical vulnerability in Discourse, tracked as CVE-2026-55420. This flaw could let a low-privileged user read and write files on the underlying server by exploiting the platform’s ImageMagick-based upload pipeline. The issue was fixed for hosted customers in June 2026 and was publicly disclosed on June 30, 2026. The vulnerability affects […] The post Discourse ImageMagick Vulnerability Enables Arbitrary File Read Through Malicious Image Uploads appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from securityonline.info
Two Discourse vulnerabilities, CVE-2026-55674 and CVE-2026-55420, enable cache poisoning XSS and server file reads. Patch to the fixed relea
securityonline.info · 1d ago · October 13th, 2026
Two Discourse vulnerabilities, CVE-2026-55674 and CVE-2026-55420, enable cache poisoning XSS and server file reads. Patch to the fixed relea
via Mastodon https://securityonline.info/discourse-vulnerabilities-cve-2026-55674-cve-2026-55420/?utm_source=mastodon&utm_medium=jetpack_social