CVE-2026-45775
Description
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, a path traversal vulnerability in Discourse backup handling could allow an authenticated administrator on one site in a multisite deployment to access backup files belonging to another site when backups are stored locally. In affected configurations, an admin on Site A could potentially retrieve sensitive backup data from Site B (same host, multisite) by crafting a backup download request with a traversal payload. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.
How to fix
- discourse discourse2026.1.0, 2026.1.4, 2026.3.1, 2026.4.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| discourse discourse | v < 2026.1.0, 2026.1.0 ≤ v < 2026.1.4, 2026.3.0 ≤ v < 2026.3.1, 2026.4.0 ≤ v < 2026.4.1, 2026.5.0 | 2026.1.0, 2026.1.4, 2026.3.1, 2026.4.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.