All vulnerabilities

Servers and applications

CVE-2025-69218

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can access the `top_uploads` admin report which should be restricted to admins only. This report displays direct URLs to all uploaded files on the site, including sensitive content such as user data exports, admin backups, and other private attachments that moderators…

Severity
High 7.1
Published
28 Jan 2026
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.5.4, 2025.11.2
Sources
NVD

Affected software

SoftwareAffected versions
DiscourseServers and applications · cpe:a:discourse:discourse
  • Every version before 3.5.4
  • From 2025.11.0 before 2025.11.2
  • Version 2025.12.0
  • Version 2026.1.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-69218
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-69218