CVE-2026-45775: Discourse Path Traversal in Multisite Backup Handling

Technical summary

CVE-2026-45775 is a path traversal vulnerability (CWE-22) in Discourse's backup download functionality. The vulnerability exists in the backup retrieval mechanism when processing authenticated download requests in multisite configurations. By manipulating the backup request parameters with directory traversal sequences (e.g., ../ payloads), an authenticated administrator can escape the intended backup directory scope and access backup files belonging to other sites sharing the same local storage infrastructure. The vulnerability requires high privilege level (administrator role) and is not exploitable remotely without prior authentication. The attack surface is limited to multisite deployments using local backup storage, not applicable to systems using remote backup storage solutions (S3, etc.).

Business impact

In affected multisite Discourse deployments, this vulnerability enables unauthorized cross-site data access by privileged users. A compromised or malicious administrator account on one community site could exfiltrate sensitive backups from other sites, including user data, private discussions, and configuration information. For hosting providers or organizations managing multiple Discourse communities on shared infrastructure, this represents a significant data isolation failure. The blast radius depends on deployment architecture—single-tenant or isolated storage deployments are unaffected. Organizations should evaluate whether their Discourse deployment hosts sensitive multi-tenant data that would warrant immediate patching.

Affected systems

The vulnerability affects Discourse versions 2026.1.0 through 2026.1.3, all releases from 2026.3.0 through 2026.3.0 (before 2026.3.1), and 2026.4.0 through 2026.4.0 (before 2026.4.1). Patched versions include 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 or newer. Only multisite Discourse deployments using local filesystem backup storage are affected. Single-site instances and deployments using remote backup storage (AWS S3, Google Cloud Storage, etc.) are not vulnerable. Community Managers and site administrators should verify their Discourse version and backup configuration to determine exposure.

Exploitability

Exploitation requires valid administrator credentials on at least one Discourse site within the affected multisite deployment. An attacker cannot exploit this remotely without first compromising or obtaining admin credentials. The attack requires knowledge of the backup file naming or directory structure. Once authenticated as an administrator, the exploit is straightforward—a single crafted HTTP request with path traversal payloads is sufficient to retrieve backup files from sibling sites. The CVSS vector (AV:N/AC:L/PR:H) reflects that while network-accessible, the high privilege requirement and multisite configuration limitation reduce real-world attack probability. No exploit code has been identified in public repositories.

Remediation

Immediately upgrade affected Discourse instances to patched versions: 2026.1.4 or later for the 2026.1 branch, 2026.3.1 or later for the 2026.3 branch, 2026.4.1 or later for the 2026.4 branch, or 2026.5.0-latest.1 or newer. For organizations unable to patch immediately, implement access controls to restrict backup download permissions to minimal necessary personnel and monitor admin API activity for suspicious backup requests. Consider migrating backup storage to external services (S3, Cloud Storage) as a compensating control until patches are deployed.

Patch guidance

Deploy patches according to your Discourse release track: the 2026.1 stable track should upgrade to 2026.1.4 or later; 2026.3 track to 2026.3.1 or later; 2026.4 track to 2026.4.1 or later. Organizations on the latest/unstable track should ensure they are running 2026.5.0-latest.1 or later. Patches should be tested in a staging environment before production deployment, particularly in multisite configurations. After patching, verify that backup isolation is enforced by confirming administrators cannot access cross-site backup download endpoints. Rolling deployments are recommended to minimize downtime for high-availability Discourse installations.

Detection guidance

Monitor Discourse admin logs and web server access logs for suspicious backup download requests originating from administrator accounts. Look for HTTP requests to backup endpoints containing path traversal sequences (../, ..\, or URL-encoded variants) or requests attempting to access backup file paths that do not correspond to the requesting administrator's site. In multisite deployments, flag any backup download attempts by administrators from outside their authorized site scope. Review audit logs for the modified date range (June 12–17, 2026) and forward to identify if unauthorized backup access occurred. Network segmentation monitoring can also detect unusual filesystem access patterns by the Discourse application process.

Why prioritize this

This vulnerability should be patched within 2–3 weeks for multisite Discourse deployments; single-site instances can be prioritized lower. The CVSS 6.8 (MEDIUM) score reflects the high privilege requirement and limited scope, but the impact is significant: successful exploitation leads to complete confidentiality breach of backup files containing sensitive user and community data. Organizations managing multiple customer or partner communities on shared infrastructure should treat this as elevated priority due to compliance implications (data isolation failures may violate contractual data protection agreements). The relatively simple patch process and wide availability of fixes supports rapid remediation.

Risk score, explained

The CVSS v3.1 score of 6.8 (MEDIUM severity) reflects: (1) Network accessibility (AV:N) but requiring prior admin authentication; (2) Low attack complexity (AC:L)—once authenticated, exploitation is straightforward; (3) High privilege requirement (PR:H)—only site administrators can exploit; (4) Changed scope (S:C)—the attack crosses site boundaries in multisite deployments; (5) High confidentiality impact (C:H)—backup files contain sensitive data; (6) No integrity or availability impact (I:N/A:N). The score is tempered by privilege requirements but elevated by scope changes and confidentiality impact. Organizations with isolated single-site deployments or external backup storage should rate risk lower; multisite setups should view this as approaching HIGH priority.

Frequently asked questions