CVE-2026-55420

CVSS 3.1: 8.1 high
EPSS: <1%p47
Published: Jul 9, 2026 · Jul 9, 2026
Modified: Jul 14, 2026

Analyze CVE-2026-55420 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of PDF uploads could be exploited to obtain RCE on the server. This issue is patched in 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Vendors: discourse

Products: discourse

Weakness: CWE-78

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news

2 stories

Discourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for File Read

Searchlight Cyber showed a patched Discourse upload chain letting basic users read server files via ImageMagick.

Cyber Security NewsOct 12, 06:43 UTC · 28d agoVulnerabilityCVE-2026-554204

Discourse ImageMagick Vulnerability Enables Arbitrary File Read Through Malicious Image Uploads

Researchers disclosed CVE-2026-55420, letting low-privilege Discourse users read server files via ImageMagick uploads.

GBHackersOct 12, 11:13 UTC · 28d agoVulnerabilityCVE-2026-554207 · 2 reads