CVE-2024-53991

CVE-2024-53991 is an information exposure flaw (CWE-200) in Discourse, the open source community discussion platform, affecting only instances where uploads and backups are stored locally on disk via FileStore::LocalStore. An unauthenticated remote attacker who knows or can guess the name of the Discourse backup file can send a crafted request that tricks nginx into serving the backup file directly. Because backups typically contain a full dump of the site database, the attacker can gain potentially sensitive user data such as account records and site content. Only Discourse deployments using local backup storage are affected; the issue is fixed in the latest stable, beta, and tests-passed versions. No exploitation is confirmed, but EPSS assigns a relatively high 26.8% probability of exploitation within 30 days (98th percentile), with no public PoC and no CISA KEV listing.

What to do: Upgrade Discourse to the latest stable, beta, or tests-passed version, which contains the fix. If upgrading is not immediately possible, either download all local backups to separate storage, disable the enable_backups site setting, and delete backups until upgraded, or change the backup_location site setting to s3 so backups are stored and downloaded directly from S3. Administrators should confirm whether their instance uses local backup storage, since S3-backed and hosted instances are not affected.