Discourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for File Read

A Discourse image upload exploit allowed basic users to read server files by chaining a JPEG processing delay, Ghostscript execution, and ImageMagick features.

The research also exposed a separate cache poisoning flaw that could run JavaScript for anonymous visitors. Researchers reported both issues in June 2026 and patched them before publication.

The technical report from Searchlight Cyber describes testing against default configurations. Discourse powers more than 22,000 communities, making its upload handling a valuable security target.

The findings are independent of Hacktron’s OpenAI research, which involved different image decoder and sign-on bugs, previously covered by Cybersecurity News. The file read chain required only a Trust Level 0 account, the lowest user trust level.

Discourse Image Pipeline Exploit

Researchers examined the profile picture upload flow and found that ImageMagick’s security policy blocked PostScript formats but still allowed Ghostscript to process PDFs. This created a gap between the blocked format and the tool used to process it.

A crafted file combined JPEG XL identification bytes with valid PostScript content. FastImage, the library checking uploads, recognized image dimensions, while the file’s PDF extension directed ImageMagick toward Ghostscript.

Ghostscript then interpreted the content as PostScript. The researchers achieved this without using a Ghostscript vulnerability or breaking its patched sandbox.

That first stage reached Discourse’s dominant color calculation, which passed the temporary file path to ImageMagick without forcing a specific image decoder.

Related ImageMagick vulnerability coverage highlights why these processing tools need close security review. Here, however, the chain depended on how several components handled the same uploaded file.

The next step exploited a race between checking a file and later using it, known as a time-of-check to time-of-use flaw. Researchers uploaded valid JPEG content with an .msvg extension, then replaced the temporary file after FastImage checked it but before ImageMagick processed its dominant color.

The normal timing window was too short for reliable exploitation. A specially padded JPEG slowed the jpegoptim processing stage to about 25 seconds in testing.

PostScript’s rename operation then replaced the file atomically, keeping existing file handles tied to the original JPEG while later reads reached the replacement SVG.

ImageMagick’s internal MSVG parser followed an embedded reference to Magick Scripting Language, or MSL. That script read a local file and saved its contents as an image.

A second pass placed that image into the upload storage flow, which returned a normal download URL. Researchers demonstrated file disclosure, not full server code execution.

The separate cache flaw reflected an unchecked color scheme cookie into HTML and stored the response in the anonymous cache. A trusted plugin loader then imported an attacker-controlled module, bypassing the site’s Content Security Policy.

Discourse patched both issues. The image fix blocks delegates and permits only needed decoders. Cookie handling now uses strict integer validation and includes the value in cache keys.

The vendor’s CVE-2026-55420 advisory lists patched releases 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5. Its description concerns non-default PDF configurations, narrower than the researchers’ default-configuration chain. Administrators should update rather than rely solely on extension restrictions.

Stops threats before impact with a 21 min faster MTTR. Integrate ANYRUN’s Sandbox into your SOC