CVE-2026-91133

Executive Summary

CVE-2026-91133 is an improper neutralization of SQL special elements (CWE-943) in Discourse, the open-source discussion platform. Authenticated users can supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to match unrelated upload records instead of a literal identifier, which resolves upload objects the user is not authorized to access and discloses restricted metadata such as original filenames and secure-upload paths. The issue affects all releases prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, and carries a CVSS v3.1 base score of 6.5 (Medium).

Technical Analysis

Discourse is an open-source discussion platform. Per the vendor description, the affected code accepts user-supplied input used to resolve uploads, and prior to the fixed releases this input was not neutralized against SQL LIKE metacharacters. In SQL, the LIKE operator treats % and _ as wildcard characters:

• % matches any sequence of zero or more characters.
• _ matches any single character.

When this input is concatenated into a database query without escaping those metacharacters, a value the operator intends as a literal identifier is instead interpreted as a pattern. This results in an over-broad match set: the query returns upload records that the requesting user should not have matched, rather than only the specific record corresponding to the supplied identifier.

The NVD description names three affected resolution paths:

• Upload metadata resolution
• URL-lookup resolution
• Cooked-video-placeholder resolution

In each of these paths, the wildcard behavior causes the resolver to return unrelated upload records, and the response can therefore contain data the user was not authorized to view. Explicitly disclosed data includes:

• Original filenames of other users' uploads
• Secure-upload paths (the storage location of protected uploads)

Crucially, the issue is a read-only authorization bypass — the description states the manipulation occurs "without modifying the upload records." There is no integrity impact (CVSS I:N). The underlying weakness class is CWE-943 (Improper Neutralization of Special Elements in Data Query Logic), a parent category that subsumes SQL-injection-like flaws resulting from unescaped special characters in query logic. This is not a full arbitrary-query injection; the impact is bounded by the resolver's query shape, but the confidentiality exposure is rated High (C:H) because a lower-privileged, authenticated user can retrieve restricted upload metadata belonging to others.

The attack surface is the upload-resolution API as exposed to any authenticated session. No user interaction is required (UI:N), and the network attack vector (AV:N) with low attack complexity (AC:L) reflects that a single crafted request is sufficient. Privileges required are Low (PR:L), consistent with a standard authenticated account. Scope is unchanged (S:U).

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for this CVE. The attack chain below is described at the vulnerability-class level and is inferred from the NVD description; specific endpoint paths, parameter names, and internal function names are not disclosed and are therefore not fabricated here.

1. Reconnaissance / target identification. The attacker identifies a Discourse instance running a vulnerable release (any version prior to 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0). Because only authenticated users can reach the affected code paths, the attacker must possess a valid account — including the low-privilege account typically granted by open self-registration on many Discourse forums.

2. Triggering the flaw. The attacker locates the upload-resolution functionality that accepts a user-supplied upload identifier (the upload metadata path, the URL-lookup path, or the cooked-video-placeholder path). Instead of submitting a literal identifier, the attacker submits a value containing SQL LIKE metacharacters (% or _) — for example, a broad pattern intended to match many records. Because the input is not escaped before being incorporated into the LIKE comparison, the database evaluates it as a wildcard pattern rather than a literal string.

3. Payload / execution method. The payload is an identifier string containing wildcard characters. The flaw is triggered by the mere act of sending this string to a resolution endpoint; the database returns the set of upload records that match the expanded pattern instead of the single intended record. No code execution, file upload, or privilege escalation is required — the substitution of literal semantics for pattern semantics is the entire exploit.

4. Post-exploitation impact. The resolver returns metadata for upload records the attacker is not authorized to access. This leaks original filenames and secure-upload paths, which the description identifies as the disclosed data. The records themselves are not modified. The attacker gains an enumeration and information-disclosure primitive: by iterating wildcard patterns, an attacker can systematically map other users' private uploads, harvesting filenames and storage paths. The leaked secure-upload paths may themselves enable further targeted attempts against private content, though this CVE alone does not confer read access to the file contents.

Impact Assessment

The CVSS v3.1 base score is 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. Subscore interpretation:

• Confidentiality: High. Original filenames and secure-upload paths belonging to other users are disclosed. These are restricted metadata that can reveal sensitive information about a forum's private content — filenames frequently embed descriptive, identity-revealing, or otherwise sensitive strings.
• Integrity: None. The description explicitly states upload records are not modified.
• Availability: None. No denial-of-service element is described.
• Privileges Required: Low. Any authenticated user, including self-registered low-privilege accounts, can attempt exploitation.
• User Interaction: None. The victim does not need to take any action.
• Scope: Unchanged. The impact remains within the vulnerable component's security authority.
• Attack Vector: Network / Complexity: Low. Exploitation is a single crafted request over the network.

Blast radius. Any Discourse instance running a version below the fixed releases, with self-registration or attacker-controlled authenticated accounts, is exposed. Because the primitive is enumeration-friendly, the practical impact scales with the number of private uploads on the forum: an attacker can harvest metadata across many uploads rather than a single one. Private or restricted-category forums that rely on upload confidentiality (legal, healthcare, internal corporate, or membership communities) face the greatest exposure, since filenames and secure-upload paths may themselves constitute sensitive information. No EPSS score is yet available from FIRST.org, and the CVE is not listed in CISA KEV, so there is no confirmed exploitation-in-the-wild evidence at this time.

Detection Guidance

Sigma Rule

title: Potential Discourse Upload-Resolution LIKE Wildcard Abuse (CVE-2026-91133)
id: 3f2a9c1e-7b64-4d18-9c2e-91133a1b2c3d
status: experimental
description: Detects authenticated upload-resolution requests containing SQL LIKE
  wildcard metacharacters (% or _) targeting Discourse upload metadata, URL-lookup,
  or cooked-video-placeholder resolution paths, consistent with CVE-2026-91133.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91133
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1213
  - cve.2026.91133
logsource:
  category: webserver
  product: discourse
detection:
  selection_path:
    cs-uri-query|contains:
      - 'upload'
      - 'url'
      - 'video'
  selection_wildcard:
    cs-uri-query|contains:
      - '%25'
      - '_'
  filter_benign:
    cs-uri-query|contains:
      - 'filename='
      - 'search='
  condition: selection_path and selection_wildcard and not filter_benign
falsepositives:
  - Legitimate search queries containing underscore characters in identifiers
  - URL-encoded percent signs in normal request parameters
level: medium

YARA Rule

rule CVE_2026_91133_Discourse_LIKE_Wildcard
{
    meta:
        description = "Detects Discourse request artifacts containing SQL LIKE wildcard metacharacters targeting upload resolution, consistent with CVE-2026-91133"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91133"
        date = "2026-01-01"
        cve = "CVE-2026-91133"

    strings:
        $a1 = "upload" nocase
        $a2 = "url-lookup" nocase
        $a3 = "video-placeholder" nocase
        $w1 = "%25" ascii
        $w2 = "LIKE" nocase

    condition:
        (any of ($a*)) and ($w1 or $w2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91133 Discourse Upload-Resolution LIKE Wildcard Abuse Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"upload"; nocase; http.uri; content:"%25"; nocase; reference:cve,2026-91133; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91133; classtype:attempted-recon; sid:9113301; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=30s
  [http where http.request.method == "GET" and
     wildcard(http.request.uri.path, "*upload*")]
  [http where wildcard(http.request.uri.query, "*%25*") or
     wildcard(http.request.uri.query, "*_*")]

Splunk SPL Query

index=web sourcetype=discourse_access
| eval uri=coalesce(uri, uri_query, cs_uri_query)
| where (like(uri, "%upload%") OR like(uri, "%url%") OR like(uri, "%video%"))
| where (like(uri, "%25") OR like(uri, "%\_%"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri
| where count > 1
| sort - count

Wazuh OSSEC Rule

<group name="discourse,web,cve-2026-91133,">
  <rule id="911330" level="10">
    <if_sid>31100</if_sid>
    <match>upload|url-lookup|video-placeholder</match>
    <regex>%25|LIKE|_</regex>
    <description>CVE-2026-91133: Possible Discourse upload-resolution LIKE wildcard abuse attempt</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cve_2026_91133,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or OSV package mapping was provided in the tracked intelligence for this CVE, and the affected-version list is empty in the source data. The vendor's own advisory name fixed releases (2026.1.8, 2026.6.3, 2026.7.2, 2026.8.0), but no patch source has been independently confirmed.

1. Immediate mitigations

   • Treat the affected code paths as read-only information-disclosure vectors and restrict authenticated account creation where feasible (disable open self-registration or gate it behind approval) to reduce the population of principals able to reach the resolver.
   • Limit the confidentiality sensitivity of uploaded content and filenames during the exposure window; avoid embedding sensitive identifiers in upload filenames.
   • Monitor and rate-limit authenticated requests to upload-resolution functionality for wildcard-like input as described in the Detection Guidance above.
   • Apply least-privilege and category restrictions so that uploads most likely to be sensitive (secure/private uploads) are minimized.

2. Patch / upgrade steps

   • Upgrade Discourse to 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0 (or later) on the appropriate release branch.
   • Because patch confidence is 0/4, validate the fix against the actual deployed branch before considering the instance remediated, and track the vendor's release notes for this CVE.
   • Confirm the upgrade addressed the upload metadata, URL-lookup, and cooked-video-placeholder resolution paths named in the advisory.

3. Long-term hardening

   • Enforce parameterized queries and explicit escaping/neutralization of SQL LIKE metacharacters (%, _) at all points where user input is incorporated into query logic — the core CWE-943 remediation.
   • Add code-review and SAST gates that flag unescaped LIKE pattern input and other "special element in query logic" patterns.
   • Maintain inventory and rapid-upgrade capability for internet-facing Discourse deployments, and subscribe to the project's security advisories.
   • Adopt a routine that treats third-party discussion platforms as authentication-bearing sensitive-data repositories, applying the same query-safety standards as first-party applications.

References

• NVD — CVE-2026-91133: https://nvd.nist.gov/vuln/detail/CVE-2026-91133
• CWE-943 — Improper Neutralization of Special Elements in Data Query Logic: https://cwe.mitre.org/data/definitions/943.html
• Discourse security releases / release notes (vendor) for versions 2026.1.8, 2026.6.3, 2026.7.2, 2026.8.0
• MITRE ATT&CK — T1213 Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-91133 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, EPSS score, or CISA KEV entry is associated with CVE-2026-91133 in the data provided. No threat-actor campaigns or exploit-in-the-wild evidence have been identified.