CVE-2025-22601CWE-22

Client Side Path Traversal using activate account route in Discourse

Low · published February 4, 2025

CVSS v3.1
3.1
EPSS
0%
Percentile
29.8
In the wild
Unconfirmed
What it is

Discourse is an open source platform for community discussion. In affected versions an attacker can trick a target user to make changes to their own username via carefully crafted link using the `activate-account` route. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00370 · 29.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-02-04T20:53Z
EPSS history
Timeline
  • 04 FEB 20:53Z
    Client Side Path Traversal using activate account route in Discourse
    cvelistv5