Discourse S3 Upload Vulnerability Allowing Script Execution in HTML/XML Files

A vulnerability in Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 allows for the execution of scripts in uploaded HTML or XML files on S3. While the scripts can be executed, they will only run in the context of the S3/CDN domain, without any site credentials. This vulnerability affects users who utilize S3 for file uploads.

Impact

Exploitation of this vulnerability could lead to unauthorized script execution in the context of the S3/CDN domain, potentially allowing for malicious actions to be performed from that domain.

Remediation

Users can upgrade to Discourse versions 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0 to address this vulnerability. As a workaround, HTML or XML files should be disallowed in the authorized_extensions for uploads. For sites with existing HTML or XML uploads, it is recommended to delete those files.