Discourse: Searchlight Cyber details a lowest-trust-level file read chain through ImageMagick and Ghostscript (CVE-2026-55420) and unauthenticated cache poisoning to sitewide JavaScript execution (CVE-2026-55674, CVSS 9.3); both fixed in Discourse 2026 releases

Searchlight Cyber researcher Kevin Gervot published a write-up on 7 October 2026 of two flaws in Discourse, the open-source forum platform Searchlight says powers more than 22,000 communities, including OpenAI, Atlassian and Cloudflare. Both were reported to Discourse on 9 June 2026 and affect default configurations. First, the color_scheme_id (and dark_scheme_id) cookie was written into a page tag without escaping and was not part of the anonymous page-cache key, so a single unauthenticated request could poison the cached page and run attacker JavaScript for every anonymous visitor, getting past Discourse's nonce-based Content Security Policy (CVE-2026-55674, CVSS 3.1 9.3). Second, a Trust Level 0 account, the lowest user level, could read files from the server through the profile picture upload. ImageMagick's policy blocked PostScript but still let Ghostscript handle files with a .pdf extension. Searchlight padded a JPEG so jpegoptim took about 25 seconds to process it, then used Ghostscript file operators that still work under its -dSAFER sandbox to swap the temporary file before ImageMagick computed the image's dominant colour. ImageMagick's MSVG coder then ran a Magick Scripting Language file that read a local file and saved it as an image, and Discourse handed it back as a normal upload URL (CVE-2026-55420). No Ghostscript zero-day was needed. Searchlight stopped at file read, but warns that reading Rails secrets such as secret_key_base could lead on to code execution. Discourse's CVE record for 55420 is titled remote code execution via PDF uploads, rates it CVSS 3.1 7.5 and says it needs certain non-default configurations. Discourse fixed its hosted sites on 15 June and published the ImageMagick fix on 30 June and the cache fix on 28 July. The fix adds a default-deny ImageMagick policy that blocks all delegates (no Ghostscript) and allowlists only the coders Discourse needs, and makes the colour-scheme cookies strict integers that are part of the cache key. This is separate from Hacktron's libheif research on this desk. No exploitation has been reported. Wire: Cybersecurity News 12 Oct.

Product

Discourse (self-hosted forum platform; ImageMagick upload pipeline and anonymous page cache)

Versions

CVE-2026-55420: 2026.1.x before 2026.1.5, 2026.4.x before 2026.4.2, 2026.5.x before 2026.5.1 (fixed in 2026.6.0). CVE-2026-55674: before 2026.1.6, 2026.5.x before 2026.5.2, 2026.6.x before 2026.6.1 (fixed in 2026.7.0). Discourse-hosted sites fixed 15 Jun 2026.

CVSS

9.3 (CVE-2026-55674) and 7.5 (CVE-2026-55420), CVSS 3.1 from the Discourse CVE records

Exploited in Australia?

unknown

Patch to

Self-hosted Discourse: upgrade to 2026.7.0 or later, or at least 2026.1.6, 2026.5.2 or 2026.6.1 on those branches, which carry both fixes. If an unpatched forum allowed open sign-ups, consider rotating Rails secret_key_base and other secrets in the server environment, since the file read could reach them. Hosted Discourse customers need no action.

Primary: Searchlight Cyber — A JPEG, a Race, and a Ghost: Breaking Discourse's Image Pipeline (Kevin Gervot, 7 Oct 2026) · Vendor: Discourse advisory GHSA-qx4v-rg4v-pm2g — cache poisoning/XSS via color scheme cookies (CVE-2026-55674) · CVE: CVE-2026-55420, CVE-2026-55674 · Discourse advisory GHSA-7wq5-jgww-5rw3 — PDF upload processing (CVE-2026-55420)

vulnerabilities