CVE-2025-66488
BaseFortify
Publication date: 2026-01-28
Last updated on: 2026-01-30
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | to 3.5.4 (exc) |
| discourse | discourse | From 2025.11.0 (inc) to 2025.11.2 (exc) |
| discourse | discourse | 2025.12.0 |
| discourse | discourse | 2026.1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-116 | The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 when using S3 for uploads. It allows scripts to be executed, but only within the context of the S3/CDN domain and without access to site credentials. The issue can be mitigated by disallowing HTML or XML files for uploads or deleting existing HTML/XML uploads.
How can this vulnerability impact me? :
The vulnerability can lead to script execution in the S3/CDN domain context, which may result in limited integrity and availability impacts. However, since scripts run without site credentials, the risk to site security is reduced. The CVSS score indicates a moderate impact with potential for limited integrity and availability loss.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if your Discourse installation is running a version prior to 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0 and if you are using S3 for uploads. Additionally, you can inspect your uploads for any html or xml files, which are vulnerable. Specific commands are not provided in the context.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Discourse to version 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0. As a workaround, disallow html or xml files for uploads by configuring the authorized_extensions setting. For existing html or xml uploads, consider deleting those files.