CVE-2025-59337: Discourse RCE Vulnerability via Backups

CVE-2025-59337 Overview

CVE-2025-59337 is a command injection vulnerability [CWE-77] affecting Discourse, an open-source community discussion platform. In versions 3.5.0 and earlier, an administrator can embed malicious PostgreSQL meta-commands within a backup dump file. When the backup is restored, the database restorer executes these meta-commands with the privileges of the restore process.

In multisite Discourse deployments, this behavior enables an administrator of one site to read data or credentials belonging to other tenants sharing the same database cluster. The Discourse maintainers addressed the issue in version 3.5.1.

Critical Impact

A site administrator in a multisite Discourse deployment can access data and credentials belonging to other sites by uploading a crafted backup archive.

Affected Products

• Discourse stable releases up to and including 3.5.0
• Discourse beta releases up to and including 3.5.0
• Discourse 3.6.0.beta1

Discovery Timeline

• 2025-10-01 - CVE-2025-59337 published to the National Vulnerability Database
• 2025-10-01 - GitHub Security Advisory GHSA-7xjr-4f4g-9887 published by the Discourse maintainers
• 2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-59337

Vulnerability Analysis

Discourse restores database backups by feeding a SQL dump into the PostgreSQL client. The restorer strips a denylist of dangerous statements from the dump before execution using a sed filter. Prior to 3.5.1, that denylist did not include the psql meta-commands \restrict and \unrestrict, which control command execution safety modes introduced in newer PostgreSQL client versions.

By embedding these meta-commands in a backup dump, an administrator can disable the restrictions the client would otherwise enforce during restore. The resulting execution context permits statements that reach beyond the current site's schema. In shared multisite deployments where several tenants coexist in one database cluster, this cross-tenant reach exposes other sites' user data and credentials.

The issue is classified as CWE-77 (Improper Neutralization of Special Elements Used in a Command). Exploitation requires administrator privileges on at least one site, so the vulnerability is not usable by unauthenticated actors.

Root Cause

The root cause is an incomplete denylist in lib/backup_restore/database_restorer.rb. The pre-restore sanitizer removed known dangerous SQL statements but did not filter psql meta-commands that alter execution safety, allowing meta-commands embedded in the backup to be honored during restore.

Attack Vector

An authenticated administrator uploads a crafted backup archive containing embedded \restrict or \unrestrict meta-commands. When Discourse restores the archive, the meta-commands run against the PostgreSQL cluster. In multisite deployments, this reads or manipulates data belonging to other tenants sharing the cluster.

         "CREATE SCHEMA", # PostgreSQL 11+
         "COMMENT ON SCHEMA", # PostgreSQL 11+
         "SET default_table_access_method", # PostgreSQL 12
+        "\\\\restrict",
+        "\\\\unrestrict",
       ].join("|")

       command = "sed -E '/^(#{unwanted_sql})/d' #{@db_dump_path}"

Source: Discourse commit 43536b6. The patch extends the denylist consumed by the pre-restore sed filter so that lines beginning with \restrict or \unrestrict are removed before the dump is handed to psql.

Detection Methods for CVE-2025-59337

Indicators of Compromise

• Backup archives containing lines that begin with \restrict or \unrestrict meta-commands.
• Restore job logs referencing schemas, roles, or tables outside the current site's namespace.
• Unexpected queries against other tenants' schemas originating from the Discourse database user shortly after a restore operation.

Detection Strategies

• Inspect stored backup archives for embedded psql meta-commands prior to restore.
• Enable PostgreSQL log_statement = 'all' for the Discourse database user and review restore-window activity for cross-schema access.
• Audit Discourse admin actions for backup uploads and restore events, correlating them with the account and source IP that initiated them.

Monitoring Recommendations

• Alert on any administrator-initiated backup restore in production multisite environments.
• Monitor PostgreSQL role and search_path changes that occur outside deployment windows.
• Track access to backup upload endpoints and flag uploads from newly created or recently privileged admin accounts.

How to Mitigate CVE-2025-59337

Immediate Actions Required

• Upgrade Discourse to version 3.5.1 or later on all sites in the cluster.
• Review the admin user list on every site in a multisite deployment and revoke unnecessary administrator accounts.
• Rotate database credentials and any secrets that may have been exposed if a suspicious restore has occurred.

Patch Information

The fix is delivered in Discourse 3.5.1 through commit 43536b60d012cc8084e7e701d6afab9ba01e28a5. The change adds \restrict and \unrestrict to the sanitizer denylist applied to backup dumps before restore. Refer to GitHub Security Advisory GHSA-7xjr-4f4g-9887 for full advisory text.

Workarounds

• Restrict backup restore functionality to a small set of trusted operators until the upgrade is applied.
• Manually inspect any backup archive for \restrict or \unrestrict lines before performing a restore.
• In multisite deployments, isolate tenant databases where feasible so that a restore cannot reach another tenant's schema.

# Verify a backup archive is free of the meta-commands abused by CVE-2025-59337
tar -xOzf discourse-backup.tar.gz dump.sql | grep -nE '^\\(restrict|unrestrict)\b' && echo 'UNSAFE: do not restore' || echo 'OK'