Skip to content
Heist/ feed
MediumFix available

Discourse: Chat upload filenames rendered as raw HTML in excerpts

Type: advisorySource: OSV1 source record

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was then interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. The issue allowed trusted-HTML injection that altered rendered excerpt content, but JavaScript execution was not demonstrated with default Content Security Policy settings. The advisory states that no confidentiality, integrity, or availability impact was identified, while its structured scoring metadata separately assigns low integrity impact. Sites that disable or relax the default CSP have increased exposure. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

Announced Source revision 1
Original source ↗

BIT-discourse-2026-91121

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:BIT-discourse-2026-91121

discourse

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
2026.8.0

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2026.8.0"
          }
        ]
      }
    ],
    "package": {
      "name": "discourse",
      "purl": "pkg:bitnami/discourse",
      "ecosystem": "Bitnami"
    },
    "severity": [
      {
        "type": "CVSS_V3",
        "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
      }
    ],
    "database_specific": {
      "source": "https://github.com/bitnami/vulndb/tree/main/data/discourse/BIT-discourse-2026-91121.json"
    }
  }
]
Related CVEs
CVE-2026-91121

Source reference: /aliases

Publisher severity

medium

Source reference: /database_specific/severity

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-91121 · Medium

discourse

Event
#59651 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement