CVE-2026-91123

Executive Summary

CVE-2026-91123 is a path traversal vulnerability (CWE-22) in Discourse, the open-source discussion platform, affecting versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0. The flaw allows an attacker to bypass the administrator-configured allowed_iframes subpath guard by supplying a crafted iframe source containing literal backslashes, causing the browser to normalize the URL and load content from a location the administrator did not authorize. With a CVSS score of 7.2 (High), the impact is scoped to content loading outside the intended allowlist, presenting limited but non-trivial confidentiality and integrity exposure for deployed forums.

Technical Analysis

The vulnerability resides in the Discourse iframe source traversal guard — the logic responsible for validating that any embedded iframe src matches a subpath explicitly permitted by an administrator via the allowed_iframes configuration.

The core defect, as described by NVD, is a parsing mismatch between the application's guard and the browser's URL normalization:

1. Decoded dot segments — The guard processes dot segments (. and ..) after some form of decoding. A naive or inconsistent decode step can cause the guard to evaluate a different string than the one the browser ultimately resolves.
2. Literal backslashes not treated as separators — After decoded dot segments, the guard does not treat literal backslash (\) characters as path separators. In URL parsing, browsers frequently normalize a backslash to a forward slash (/), meaning a string the guard reads as a single benign segment may be interpreted by the browser as a multi-segment traversal path.
3. Guard vs. browser divergence — This divergence is the classic "canonicalization gap" that defines CWE-22. The guard concludes the source sits within an allowed subpath; the browser, applying its own normalization rules, resolves the URL to a path outside that allowed prefix.
4. Result — The iframe loads content from an origin/location the administrator did not explicitly allow, defeating the purpose of the allowed_iframes allowlist.

The attack surface is any Discourse deployment where administrators have configured allowed_iframes subpath restrictions and where untrusted users can influence iframe src values (e.g., via post content, embeds, or theming input, depending on surface configuration). The CVSS vector (S:C — Changed scope) correctly reflects that the security authority of one component (the guard) is subverted to affect another component (the rendered browser context).

Per the NVD description, there is no indication of code execution, SQL injection, or arbitrary file write. This is strictly an allowlist-bypass/canonicalization flaw.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available; the attack chain below is inferred strictly from the NVD description and the vulnerability class. Only terms present in the description (iframe src, allowed_iframes, subpath check, decoded dot segments, literal backslashes, browser URL normalization) are used.

1. Reconnaissance / target identification — An attacker identifies a Discourse instance running a version prior to the fixed releases (2026.1.8, 2026.6.3, 2026.7.2, 2026.8.0). The attacker determines, or assumes, that the administrator has configured allowed_iframes with subpath-level restrictions, since the guard only becomes relevant when such a policy exists.

2. Triggering the flaw class — The attacker crafts an iframe src value that contains decoded dot segments combined with literal backslash characters. The intent of the construction is that:

   • The Discourse allowed_iframes subpath check evaluates the string and concludes it falls within an allowed path prefix.
   • The browser subsequently applies URL normalization (treating the backslash as a separator and resolving dot segments), producing a final path that lies outside the allowed path.

3. Execution at the vulnerability-class level — The crafted src is rendered into a page context where the iframe is emitted. During rendering, the guard passes the value while the browser resolves it to the disallowed location, and the iframe loads content from that unauthorized place. This is a canonicalization/allowlist-bypass attack — no payload shellcode or injection string is required beyond the specially constructed path.

4. Post-exploitation impact — The immediate impact is unauthorized content loading within the Discourse page: the iframe can display or fetch content from a location the administrator's allowlist was intended to prohibit. Depending on the rendered location (e.g., an externally controlled origin), downstream consequences may include content spoofing, privacy leakage via the browser loading external resources, and phishing-style deception inside a trusted forum UI. The CVSS subscores (C:L, I:L) reflect limited, not wholesale, confidentiality and integrity impact.

Impact Assessment

• Confidentiality (C:L) — An unauthorized iframe load may cause the victim browser to fetch resources from a disallowed origin, potentially leaking referrer/context information or user metadata to a third party, but does not directly disclose server-side secrets.
• Integrity (I:L) — Content from a non-allowlisted location can be presented within the forum, enabling limited content injection/spoofing at the presentation layer.
• Availability (A:N) — No availability impact is described.
• Scope (S:C) — The security boundary of the iframe guard component is crossed, affecting the broader browser/page security context; this justifies the scope-changed metric and drives the 7.2 score.
• Blast radius — Any Discourse deployment running an affected version with allowed_iframes subpath restrictions configured. Because the flaw is network-reachable (AV:N), low complexity (AC:L), requires no privileges (PR:N) and no user interaction (UI:N), exploitation is broadly accessible to an unauthenticated network attacker wherever an injection point into iframe src exists.
• Business impact — Forums hosting user-generated content could be abused for phishing or disinformation embedded in a trusted domain, eroding user trust. No remote code execution or data-exfiltration-at-scale vector is implied by the description.

Detection Guidance

Sigma Rule

title: Discourse Iframe Src Backslash Traversal Attempt
id: 7c9f2e11-4b3a-4d8e-9a12-0c5f6e7b8d90
status: experimental
description: Detects crafted iframe src values containing literal backslashes combined with decoded dot segments, targeting the Discourse allowed_iframes subpath guard bypass (CVE-2026-91123).
logsource:
  category: web
  product: discourse
detection:
  selection_backslash:
    uri|contains: '\'
  selection_dotsegments:
    uri|re: '(\.\.|%2e%2e|%2e\.)'
  selection_iframe:
    uri|contains: 'iframe'
  condition: selection_backslash and (selection_dotsegments or selection_iframe)
falsepositives:
  - Legitimate content containing backslashes in rare edge cases
level: high
tags:
  - attack.t1190
  - cve.2026.91123

YARA Rule

rule CVE_2026_91123_Discourse_Iframe_Traversal
{
    meta:
        description = "Detects iframe src values attempting backslash-based traversal against Discourse allowed_iframes guard"
        author = "Threat Intel"
        reference = "CVE-2026-91123"
        date = "2026-01-01"
        severity = "high"
    strings:
        $iframe = "iframe" nocase
        $src = "src=" nocase
        $backslash = "\\"
        $dotdot = ".."
        $re_bs_traversal = /src\s*=\s*["'][^"']*\\\\[^"']*\.\.[^"']*["']/
    condition:
        $iframe and $src and ($backslash and $dotdot or $re_bs_traversal)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91123 Discourse Iframe Src Backslash Traversal Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"iframe"; nocase; http.uri; pcre:"/\\\\|%5c/i"; http.uri; pcre:"/\.\.|%2e%2e/i"; reference:cve,2026-91123; classtype:web-application-attack; sid:202691123; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [url where url.query contains "iframe" and url.query : "*\\*"]
  [url where url.query regex "~(?i)(\\.\\.|%2e%2e)"]

Splunk SPL Query

index=web sourcetype=discourse_access
| where match(_raw, "(?i)iframe") AND (match(_raw, "\\\\") OR match(_raw, "%5c")) AND match(_raw, "(?i)(\.\.|%2e%2e)")
| stats count values(uri) as suspicious_uris by src_ip, host
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="discourse,web,cve-2026-91123,">
  <rule id="911230" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>iframe</match>
    <regex>\\|%5c|\.\.|%2e%2e</regex>
    <description>CVE-2026-91123: Possible Discourse allowed_iframes guard bypass via backslash traversal in iframe src</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict or temporarily disable allowed_iframes functionality where operationally feasible.
   • Where a web application firewall (WAF) is in place, add rules to block request paths or parameter values containing literal backslashes (\ / %5c) combined with dot segments (..) within iframe-related parameters.
   • Limit who can create posts or content capable of emitting iframes; tighten input trust boundaries.
   • Restrict the embedding/iframe feature to trusted user groups until fixed.

2. Patch / upgrade steps

   • Referencing the NVD description, the issue is stated to be fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0. Upgrade to the appropriate fixed release for your deployment branch.
   • Note: no vendor advisory or patch source is currently tracked (patch confidence 0/4). Validate the fix availability against the official Discourse security release channel before relying on it, and confirm no interim regressions.

3. Long-term hardening

   • Enforce canonicalization before validation: normalize URL inputs (backslashes → slashes, dot-segment resolution) to a single canonical form and validate the canonical form against the allowlist, eliminating guard/browser divergence.
   • Adopt allowlist semantics based on parsed origin/host and exact path prefix rather than string matching.
   • Add regression tests covering backslash, encoded dot segments, and mixed-encoding traversal cases to the iframe guard.
   • Monitor CDN/WAF logs for traversal patterns and integrate the detection rules above into monitoring.

References

• NVD — CVE-2026-91123: https://nvd.nist.gov/vuln/detail/CVE-2026-91123
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV Catalog: NOT listed (no known exploited-vulnerability evidence for this CVE)
• Discord/Discourse security release channel: verify fixed versions (2026.1.8, 2026.6.3, 2026.7.2, 2026.8.0) against the official project release notes.

No known threat actor campaigns or exploit-in-the-wild evidence were provided in the source data. No public PoC, Nuclei template, or exploit code is available.