CRITICAL🇵🇱 Wersja polska

CVE-2022-36066

CVSS 9.1v3.1pub. 2022-09-29upd. 2024-11-21

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary locations and trigger remote code execution. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

  • Discourse

    APP
    Discourse
    2.9.0< 2.8.9
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2021-41163CRITICAL10.0PL ✓same product

RCE w Discourse poprzez brak walidacji wartości subscribe_url

CVE-2026-55424HIGH7.4PL ✓same product

XSS w Discourse via niezwalidowany 'featured link' tematu

CVE-2026-55420HIGH7.5PL ✓same product

RCE via command injection przy przetwarzaniu plików PDF w Discourse

CVE-2026-53963HIGH7.3PL ✓same product

Stored XSS w Discourse przez złośliwą nazwę drugiego składnika uwierzytelniania

CVE-2026-27934HIGH8.7same product

Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 h...