CVE-2026-91133Published
Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-91133 · Microsoft / collected KEV context
cve-program · CVE-2026-91133
- https://github.com/discourse/discourse/security/advisories/GHSA-8hxh-573g-52gx
- https://github.com/discourse/discourse/pull/42882
- https://github.com/discourse/discourse/commit/113c34d433d564bc69642649d501251a7e820b52
- https://github.com/discourse/discourse/commit/20c48bef712ee3edd4f7af58ca1123cb0c16ef6f
- https://github.com/discourse/discourse/commit/a04cab107a9f57939456181c4b082d0a34ec39bd
- https://github.com/discourse/discourse/commit/cb3ca8420fcc7aba334effd011cf41943a336fa6
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.