CVE-2026-45775: Discourse Path Traversal Vulnerability

CVE-2026-45775 Overview

CVE-2026-45775 is a path traversal vulnerability [CWE-22] affecting Discourse, an open-source discussion platform. The flaw resides in the backup handling logic of multisite deployments that store backups locally. An authenticated administrator on one site can craft a backup download request with a traversal payload to access backup files belonging to other sites hosted on the same instance. The vulnerability affects Discourse versions 2026.1.0 through 2026.1.3, 2026.3.0 through 2026.3.0, and 2026.4.0 through 2026.4.0. Patches are available in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

Critical Impact
An administrator on Site A can retrieve sensitive backup data, including database contents, from Site B in the same multisite deployment.

Affected Products

Discourse versions 2026.1.0-latest to before 2026.1.4
Discourse versions 2026.3.0-latest to before 2026.3.1
Discourse versions 2026.4.0-latest to before 2026.4.1

Discovery Timeline

2026-06-12 - CVE-2026-45775 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-45775

Vulnerability Analysis

The vulnerability stems from improper sanitization of user-supplied input in Discourse's backup download functionality. When backups are stored on the local filesystem and Discourse runs in multisite mode, the application uses tenant-scoped directories to isolate each site's backup files. The backup download handler fails to enforce that the requested filename remains within the calling site's directory boundary.

An authenticated administrator can include directory traversal sequences such as ../ in the backup filename parameter. The handler resolves the path outside the intended site directory and returns the requested file. This breaks the tenancy boundary that multisite deployments rely on for site isolation.

Backups typically contain full database dumps with user records, password hashes, private messages, and uploaded content. Cross-tenant access to these archives exposes sensitive data belonging to unrelated communities sharing the host.

Root Cause

The root cause is missing canonicalization and boundary validation on the backup filename parameter. The backup download endpoint trusts the supplied filename and joins it with the site's backup directory without verifying the resolved absolute path remains within that directory.

Attack Vector

Exploitation requires administrator-level credentials on at least one site in the multisite deployment. The attacker sends a backup download request containing relative path traversal sequences in the filename parameter. The handler resolves the path to a sibling site's backup directory and streams the file content back to the attacker. See the Discourse GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-45775

Indicators of Compromise

HTTP requests to backup download endpoints containing ../, ..%2F, or URL-encoded traversal sequences in filename parameters
Backup download requests where the resolved file path crosses site directory boundaries
Administrator accounts accessing backup files at unusual times or with abnormal frequency
Web server access logs showing successful 200 responses to backup download requests with suspicious filename parameters

Detection Strategies

Inspect Discourse application logs for backup-related controller actions invoked with non-standard filename arguments
Correlate administrator session activity with backup download events across all sites in the multisite deployment
Deploy web application firewall rules that flag path traversal patterns targeting /admin/backups/ routes

Monitoring Recommendations

Enable verbose request logging for all /admin/backups endpoints and forward logs to a centralized analysis platform
Audit filesystem access events on the backup storage directory for reads originating from unexpected site contexts
Alert on any backup download where the resolved path does not match the requesting site's tenant directory

How to Mitigate CVE-2026-45775

Immediate Actions Required

Upgrade Discourse to a patched release: 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1
Review administrator accounts across all sites in multisite deployments and rotate credentials if compromise is suspected
Audit local backup storage access logs for cross-tenant retrievals prior to patching
Restrict administrator access to trusted personnel only until patching is complete

Patch Information

Discourse has released fixes in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1. The patches enforce proper path canonicalization and validate that resolved backup file paths remain within the requesting site's directory. Refer to the Discourse GitHub Security Advisory GHSA-5j6v-4x6g-9pg5 for full release details.

Workarounds

Configure Discourse to store backups in remote object storage such as S3 instead of the local filesystem, which avoids the vulnerable code path
Temporarily disable the backup download feature for administrators until patches are applied
Apply reverse proxy rules that reject requests containing traversal sequences targeting backup endpoints

bash

# Example nginx rule to block traversal patterns on backup endpoints
location ~ ^/admin/backups/ {
    if ($request_uri ~* "(\.\./|\.\.%2f|%2e%2e/)") {
        return 403;
    }
    proxy_pass http://discourse_upstream;
}