CVE-2026-55420

Опубликовано: 09 июл. 2026

Источник: nvd

CVSS3: 7.5

CVSS3: 8.1

EPSS Низкий

Описание

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of PDF uploads could be exploited to obtain RCE on the server. This issue is patched in 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Ссылки

https://github.com/discourse/discourse/commit/ca5a7e06167561928556afa2f237d67e459c6914
Patch
https://github.com/discourse/discourse/releases/tag/v2026.1.5
Release Notes
https://github.com/discourse/discourse/releases/tag/v2026.4.2
Release Notes
https://github.com/discourse/discourse/releases/tag/v2026.5.1
Release Notes
https://github.com/discourse/discourse/releases/tag/v2026.6.0
Release Notes
https://github.com/discourse/discourse/security/advisories/GHSA-7wq5-jgww-5rw3
Mitigation
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*

Версия от 2026.1.0 (включая) до 2026.1.5 (исключая)

cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*

Версия от 2026.4.0 (включая) до 2026.4.2 (исключая)

cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*

Версия от 2026.5.0 (включая) до 2026.5.1 (исключая)

cpe:2.3:a:discourse:discourse:2026.6.0:*:*:*:latest:*:*:*

EPSS

Процентиль: 47%

0.00603

Низкий

7.5 High

CVSS3

8.1 High

CVSS3

Дефекты

CWE-78

EPSS

Процентиль: 47%

0.00603

Низкий

7.5 High

CVSS3

8.1 High

CVSS3

Дефекты

CWE-78