Researchers Detail Patched Discourse File-Read Chain CVE-2026-55420

Searchlight Cyber disclosed patched Discourse flaw CVE-2026-55420, which let basic users read server files via image uploads.

Searchlight Cyber reported a patched Discourse image-upload chain, tracked as CVE-2026-55420, that let a Trust Level 0 user read server files. One account describes a slow JPEG, a time-of-check to time-of-use race, Ghostscript, and ImageMagick MSVG and MSL handling on default configurations; the other says a polyglot upload let ImageMagick, Ghostscript, and Magick Scripting Language read or write local files such as /etc/passwd. The sources disagree on read-only versus read-and-write impact and on scope: researchers described default setups, while the vendor advisory is characterized as covering a narrower non-default PDF case, though another report says default Docker deployments were affected. A separate bug reflected an unchecked color-scheme cookie into cached HTML and could load attacker JavaScript for anonymous visitors, bypassing CSP. Both issues were reported in June 2026 and patched before publication, with hosted customers fixed that month and one report putting public disclosure on June 30. Fixes are listed for Discourse 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, and Discourse now uses a default-deny ImageMagick policy blocking unsafe delegates, including Ghostscript. Discourse is used by more than 22,000 communities.

• Searchlight Cyber reported the Discourse issues in June 2026; both were patched before publication.
• CVE-2026-55420 lists fixes in Discourse 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
• A Trust Level 0 user could read server files; one source also says the chain could write files such as /etc/passwd.
• Reports differ on the trigger (slow JPEG plus ImageMagick MSVG/MSL versus a polyglot upload) but both cite a TOCTOU race with Ghostscript and ImageMagick MSL.
• One source says default installs were affected while the vendor advisory describes a narrower non-default PDF case; the other says default Discourse Docker deployments were affected.
• A separate unchecked color-scheme cookie flaw could poison cached HTML and run attacker JavaScript for anonymous visitors, bypassing CSP.
• Hosted customers were fixed in June 2026; one report dates public disclosure to June 30, and Discourse now default-denies unsafe ImageMagick delegates, including Ghostscript.
• Discourse is used by more than 22,000 communities.