{"schema_version":"2","view":"grouped","data":[{"id":60411,"cve_ids":["CVE-2026-91123"],"payload":{"kind":"advisory","title":"Discourse: Reject literal backslash path separators in iframe src traversal guard","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91123","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-91123","aliases":["CVE-2026-91123"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-24T17:11:34.752Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318","https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24","https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be","https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91123","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T17:11:25.606443Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:11:34.752Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:54:59.357Z"}}},"related_cves":[{"value":"CVE-2026-91123","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:88d3fc2b-681c-41f7-ae5e-691a116926fe","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-91123","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91123","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91123","advisory_id":"88d3fc2b-681c-41f7-ae5e-691a116926fe","event_types":["advisory"],"published_at":"2026-10-25T18:33:29.778429+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T16:54:59.357+00:00","detail_url":"/advisories/advisory%3A88d3fc2b-681c-41f7-ae5e-691a116926fe","group":{"id":"advisory:88d3fc2b-681c-41f7-ae5e-691a116926fe","revision":1,"primary_event_id":59612,"change":"published","superseded_by":[],"changed":{"id":59612,"cve_ids":["CVE-2026-91123"],"payload":{"kind":"advisory","title":"Discourse: Reject literal backslash path separators in iframe src traversal guard","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91123","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-91123","aliases":["CVE-2026-91123"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-24T17:11:34.752Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318","https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24","https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be","https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91123","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T17:11:25.606443Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:11:34.752Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:54:59.357Z"}}},"related_cves":[{"value":"CVE-2026-91123","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:88d3fc2b-681c-41f7-ae5e-691a116926fe","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-91123","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91123","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91123","advisory_id":"88d3fc2b-681c-41f7-ae5e-691a116926fe","event_types":["advisory"],"published_at":"2026-10-25T18:33:29.778429+00:00","technologies":["core-cve","discourse"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T16:54:59.357+00:00","detail_url":"/events/59612"},"members":[{"id":59612,"cve_ids":["CVE-2026-91123"],"payload":{"kind":"advisory","title":"Discourse: Reject literal backslash path separators in iframe src traversal guard","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91123","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-91123","aliases":["CVE-2026-91123"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-24T17:11:34.752Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318","https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24","https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be","https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91123","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T17:11:25.606443Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:11:34.752Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:54:59.357Z"}}},"related_cves":[{"value":"CVE-2026-91123","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:88d3fc2b-681c-41f7-ae5e-691a116926fe","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-91123","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91123","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91123","advisory_id":"88d3fc2b-681c-41f7-ae5e-691a116926fe","event_types":["advisory"],"published_at":"2026-10-25T18:33:29.778429+00:00","technologies":["core-cve","discourse"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T16:54:59.357+00:00","detail_url":"/events/59612"}]}}],"next_after":60411,"next_before":60411}