CVE-2026-91133: Discourse SQL Injection Information Disclosure

CVE-2026-91133 Overview

Discourse, an open-source discussion platform, contains a flaw in its upload-resolution logic that allows authenticated users to supply unescaped SQL LIKE metacharacters. The wildcard input selects unrelated upload records instead of matching a literal identifier. Affected upload metadata, URL-lookup, and cooked-video-placeholder paths can resolve uploads the user is not authorized to access. The flaw enables disclosure of restricted metadata including original filenames and secure-upload paths without modifying the upload records. The issue is tracked as [CWE-943] Improper Neutralization of Special Elements in Data Query Logic.

Critical Impact
Authenticated users can enumerate and disclose metadata for restricted uploads, including original filenames and secure-upload paths they are not authorized to view.

Affected Products

Discourse versions prior to 2026.1.8
Discourse versions prior to 2026.6.3 and 2026.7.2
Discourse versions prior to 2026.8.0

Discovery Timeline

2026-09-24 - CVE CVE-2026-91133 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-91133

Vulnerability Analysis

The vulnerability affects multiple upload-resolution code paths in Discourse that build SQL LIKE queries from user-influenced data. Because the inputs are interpolated directly into the pattern, LIKE metacharacters such as % and _ are treated as wildcards instead of literal characters. An authenticated attacker can submit crafted identifiers that match upload records belonging to other users or restricted contexts. The server returns metadata for those matched uploads, including original filenames and secure-upload paths, through responses that normally only disclose the user's own content.

Root Cause

The affected methods in app/models/concerns/has_url.rb and lib/pretty_text.rb interpolated user data into LIKE patterns without calling sanitize_sql_like. Rails sanitize_sql_like escapes % and _ so they are matched literally. Without this escaping, any wildcard character in the input broadened the query match set.

Attack Vector

An authenticated user crafts upload URLs, video data-video-src values, or SHA1-shaped tokens containing LIKE wildcards. The server executes queries such as url LIKE '%<wildcard>' or original_filename LIKE '<wildcard>.%' against the uploads table. Matching rows for other users or restricted uploads are returned, leaking filenames and secure-upload URLs.

ruby

# Patch excerpt - app/models/concerns/has_url.rb
# SECURITY: Escape LIKE metacharacters in upload paths to prevent disclosure
result = self.find_by(sha1: sha1) if sha1&.length == Upload::SHA1_LENGTH
# Vulnerable:
# result || self.find_by("url LIKE ?", "%#{data[1]}")
# Fixed:
result || self.find_by("url LIKE ?", "%#{sanitize_sql_like(data[1])}")

# Patch excerpt - lib/pretty_text.rb
video_sha1 = File.basename(video_src, File.extname(video_src))
# Vulnerable:
# thumbnail = Upload.where("original_filename LIKE ?", "#{video_sha1}.%").last
# Fixed:
thumbnail =
  Upload.where("original_filename LIKE ?",
               "#{Upload.sanitize_sql_like(video_sha1)}.%").last

Source: GitHub Commit 113c34d

Detection Methods for CVE-2026-91133

Indicators of Compromise

Authenticated requests containing % or _ characters in upload URL paths, video data-video-src values, or SHA1-shaped tokens.
Application logs showing upload lookup responses returning filenames or secure-upload paths that do not belong to the requesting user.
Unusually high rates of upload metadata lookups originating from a single authenticated session.

Detection Strategies

Inspect HTTP access logs for upload resolution endpoints receiving requests with wildcard metacharacters in path or body parameters.
Correlate database query logs for LIKE queries against the uploads table with user session identity to flag cross-tenant matches.
Review post rendering and cooked-video pipeline logs for unexpected thumbnail resolution to uploads owned by other users.

Monitoring Recommendations

Enable SQL query logging on the uploads table during the remediation window to baseline normal lookup patterns.
Alert on authenticated users accessing a high volume of distinct upload records within a short interval.
Monitor outbound responses from upload endpoints for secure-upload URLs served to users without matching ACL grants.

How to Mitigate CVE-2026-91133

Immediate Actions Required

Upgrade Discourse to version 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0 as appropriate for your release branch.
Audit upload access logs for authenticated sessions that issued requests containing LIKE metacharacters prior to patching.
Rotate or invalidate secure-upload URLs that may have been disclosed to unauthorized users.

Patch Information

The fix is available in Discourse 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0. The patches wrap user-controlled input to LIKE queries with sanitize_sql_like in app/models/concerns/has_url.rb and lib/pretty_text.rb. See the GitHub Security Advisory GHSA-8hxh-573g-52gx and GitHub Pull Request #42882 for full details.

Workarounds

No official workaround is published; apply the vendor patches.
Where patching is delayed, restrict upload-related endpoints to trusted authenticated users through reverse-proxy ACLs.
Consider temporarily disabling cooked video placeholder rendering if the deployment permits it, to reduce exposure of the original_filename LIKE code path.

bash

# Example upgrade for a standard Discourse Docker deployment
cd /var/discourse
git pull
./launcher rebuild app
# Verify the running version matches a fixed release
./launcher logs app | grep -i version