The flaw lies in Discourse’s handling of PDF file uploads. When the server parses a specially crafted PDF, the underlying PDF parser can execute operating‑system commands supplied in the document. This is a classic OS command injection (CWE‑78) that yields remote code execution on the machine running the Discourse process. If exploited the attacker can gain full control over the server, compromising confidentiality, integrity, and availability.

Any Discourse instance running a build older than 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5 and configured to accept PDF uploads is vulnerable. The vendor has identified these releases as vulnerable until the patches applied in the corresponding maintenance releases including v2026.6.0 – v2026.1.5.

The CVSS score of 7.5 classifies the issue as high severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely a direct file upload to the Discourse upload endpoint; the vulnerability can be triggered by an attacker who can place a PDF on the server, a capability that in many deployments is granted to basic users or community members.