CVE-2026-55420CWE-78

Discourse: Remote code execution via pdf uploads

High · published July 9, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
48.2
In the wild
Unconfirmed
What it is

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of PDF uploads could be exploited to obtain RCE on the server. This issue is patched in 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00603 · 48.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-07-09T17:54Z
EPSS history
Timeline
  • 09 JUL 17:54Z
    Discourse: Remote code execution via pdf uploads
    cvelistv5