Discourse, an open‑source discussion platform, had a path traversal flaw in its iframe src guard, which failed to treat literal backslashes as path separators after decoding dot segments. A malicious user could craft an iframe source that passes the allowed_iframes subpath check but, due to browser URL normalization, resolves to a location outside the intended path. This allows loading of arbitrary content that the administrator did not authorize, potentially leading to cross‑site scripting or phishing attacks when users view the injected content.

The issue is present in Discourse versions older than 2026.1.8, 2026.6.3, 2026.7.2 and 2026.8.0. Administrators using these releases should consider them vulnerable until the fix is applied.

The CVSS score of 7.2 indicates a high severity, and while EPSS data is not available, the lack of listing in the CISA KEV catalog suggests no widespread exploitation yet. Nevertheless, the flaw can be abused by anyone who can add an iframe to a post or comment. An attacker could supply a crafted iframe source that circumvents the whitelist, causing the browser to request content from an arbitrary internal or external location. If the attacker controls that content, further compromise such as phishing or supply‑chain attacks is possible. The issue remains an authentication‑agnostic flaw and therefore can be triggered by unauthenticated or low‑privilege users, making it relatively low‑cost to execute.