CVE-2026-45775

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0-latest through 2026.1.3 Discourse versions 2026.3.0-latest through 2026.3.0 Discourse versions 2026.4.0-latest through 2026.4.0

Description A path traversal issue exists in the backup handling of this open-source discussion platform. In multisite deployments where backups are stored locally, an authenticated administrator of one site can access backup files belonging to another site on the same host. This is achieved by crafting a backup download request containing a traversal payload to retrieve sensitive data.

Recommendations Update versions 2026.1.0-latest through 2026.1.3 to 2026.1.4. Update versions 2026.3.0-latest through 2026.3.0 to 2026.3.1. Update versions 2026.4.0-latest through 2026.4.0 to 2026.4.1.