Discourse allows users to upload files to secure URLs, intended to be private. An attacker who can guess or obtain a secured upload path can trigger the pull_hotlinked_images function while secure_uploads is enabled, which copies the image from the remote site. Because the upload is secure, the copied image is returned with the same privacy controls, enabling the attacker to download the original file. This results in unintentional exposure of confidential data, corresponding to the CWE‑200 information‑exposure weakness.

The flaw exists in all Discourse releases before 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 that use the secure_uploads feature in conjunction with the pull_hotlinked_images API. The affected product is the Discourse discussion platform provided by the Discourse team. Versions 2026.6.0 and newer contain the fix.

The vulnerability is rated at CVSS 6.3, indicating medium severity. The EPSS score of <1% reflects a very low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. Exploitation requires web access to the Discourse instance and knowledge of a secured upload URL; this condition is inferred from the description but not directly confirmed in the CVE data. Because the flaw relies on a specific user action, the likelihood of widespread use is considered low.