CVE-2026-91123

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.8 Discourse versions prior to 2026.6.3 Discourse versions prior to 2026.7.2 Discourse versions prior to 2026.8.0

Description The iframe src traversal guard fails to treat literal backslashes as path separators following decoded dot segments. This allows a crafted source to bypass the allowed iframes subpath check because browser URL normalization can move the iframe outside the intended allowed path, enabling the loading of content from unauthorized locations.

Recommendations Update to version 2026.1.8 Update to version 2026.6.3 Update to version 2026.7.2 Update to version 2026.8.0