CVE-2026-91123 Details

A vulnerability in Discourse's iframe source traversal guard allowed for path traversal bypass, enabling unauthorized content loading. This issue affected Discourse versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0. The vulnerability arose because the traversal guard did not properly handle literal backslashes as path separators after decoding dot segments. As a result, a crafted iframe source could pass an allowed_iframes subpath check, while browser URL normalization moved the iframe outside the intended allowed path. The vulnerability has been addressed by updating the sanitizer to reject decoded dot segments followed by a backslash, closing the gap that allowed the bypass.

Users should upgrade to Discourse versions 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0.