Discourse ImageMagick Vulnerability Enables Arbitrary File Read Through Malicious Image Uploads
Researchers disclosed CVE-2026-55420, letting low-privilege Discourse users read server files via ImageMagick uploads.
58
Product
Discourse
- Mentions · 7d0
- Mentions · 30d2
- All mentions7
- First seenSep 18, 2026
- Last mentioned28d ago
Timeline
7 articles · newest firstDiscourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for File Read
Searchlight Cyber showed a patched Discourse upload chain letting basic users read server files via ImageMagick.
64
Researchers used Claude to hack OpenAI
Researchers used Claude to chain a libheif vulnerability in Discourse with an OpenAI SSO flaw, gaining access to an internal GitHub repository.
75
Claude Opus 5 Helps Researchers Weaponize HEIF Image Flaw Into Remote Code Execution
Researchers used Claude Opus 5 to help weaponize a HEIF image processing flaw into a remote code execution exploit.
72
HEIF Heist Image Flaws Let Attackers Gain RCE Across Meta, Slack and GitHub Enterprise
Hacktron's "HEIF Heist" research shows memory-unsafe HEIF/AVIF parsers enable RCE and data leaks in Slack, Meta, GitHub Enterprise, and OpenAI.
78
Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws
Hacktron researchers used Claude Opus 5 to chain a libheif flaw and OpenAI SSO weakness, taking over staff ChatGPT and Codex accounts; OpenAI paid $6,500.
62
Researchers Use Claude Opus 5 to Hack OpenAI Forum and Reach Internal Repositories
Researchers used Claude Opus 5 to build a libheif exploit that compromised OpenAI's forum, hijacked employee ChatGPT/Codex accounts, and reached the internal monorepo.
70
Related CVEs
by mentions- CVE-2026-55420<1%8.1Discourse: 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of PDF uploads could be exploited to…
- CVE-2026-32882<1%7.1libheif is a HEIF and AVIF file format decoder and encoder
- CVE-2026-19118<1%7.7Race Condition RCE in GitHub Enterprise Server
Appears with
- ImageMagickproduct · 5
- Discoursevendor · 5
- libheifproduct · 5
- Hacktronorganization · 5
- OpenAIvictim · 4
- OpenAIvendor · 3
- ChatGPTproduct · 3
- Claude Opus 5ai model · 3
- Anthropicvendor · 3
- Anthropicorganization · 3
- ImageMagickvendor · 2
- Debianvendor · 2
- libde265product · 2
- Claude Opus 4.8product · 2
- Claude Opus 5product · 2
- Claudeai model · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.