CVE-2026-91121

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.8 Discourse versions prior to 2026.6.3 Discourse versions prior to 2026.7.2 Discourse versions prior to 2026.8.0

Description Attacker-controlled upload filenames used in chat message excerpts are rendered as unescaped HTML. A user with the ability to upload files and send chat content can include markup in a filename that is subsequently interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. This allows trusted-HTML injection, which can alter the rendered content of excerpts. While JavaScript execution was not demonstrated under default Content Security Policy (CSP) settings, sites that disable or relax the default CSP face increased exposure.

Recommendations Update to version 2026.1.8. Update to version 2026.6.3. Update to version 2026.7.2. Update to version 2026.8.0.