PT-2026-56893

CVE-2026-55420

Published

2026-07-09

Updated

2026-10-15

Description by

CVSS 3.1

8.1

High

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.6.0 Discourse versions prior to 2026.5.1 Discourse versions prior to 2026.4.2 Discourse versions prior to 2026.1.5

Description Under certain non-default configurations, the processing of PDF uploads can be exploited to achieve Remote Code Execution (RCE), allowing an attacker to execute arbitrary code on the server.

Recommendations Update to version 2026.6.0 Update to version 2026.5.1 Update to version 2026.4.2 Update to version 2026.1.5

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers

CVE-2026-55420

GHSA-7WQ5-JGWW-5RW3