Discourse introduces a path traversal flaw in its local backup handling that permits an authenticated administrator in a multisite deployment to download backup files belonging to another site on the same host. The flaw, identified as CWE‑22, can leak backup data and other sensitive information, exposing site configurations, user data, or other confidential content. This unauthorized read ability threatens the confidentiality of each site’s backups when they are stored locally.

The vulnerability affects the Discourse forum platform in versions 2026.1.0 through before 2026.1.4, 2026.3.0 through before 2026.3.1, and 2026.4.0 through before 2026.4.1. Any multisite deployment where backups are stored locally is susceptible, regardless of other configuration settings.

The CVSS score of 6.8 places the issue in the medium severity range, and the EPSS score below 1% indicates an extremely low probability of exploitation in the wild. Discourse is not listed in CISA’s KEV catalog. Exploitation requires an administrator’s credentials on a different site within the same multisite installation and involves sending a crafted download request that inserts a path traversal sequence. While the attack surface may seem limited, the confidentiality impact warrants immediate action, especially in environments that keep local backups on the same server.