CVE-2025-66488

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-66488", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-02T22:44:04.706Z", "datePublished": "2026-01-28T18:15:52.902Z", "dateUpdated": "2026-01-28T19:29:11.123Z"}, "containers": {"cna": {"title": "Discourse allows script execution in uploaded HTML/XML files on S3", "problemTypes": [{"descriptions": [{"cweId": "CWE-116", "lang": "en", "description": "CWE-116: Improper Encoding or Escaping of Output", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/discourse/discourse/security/advisories/GHSA-68jp-3934-62rx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/discourse/discourse/security/advisories/GHSA-68jp-3934-62rx"}], "affected": [{"vendor": "discourse", "product": "discourse", "versions": [{"version": "< 3.5.4", "status": "affected"}, {"version": ">= 2025.11.0-latest, < 2025.11.2", "status": "affected"}, {"version": ">= 2025.12.0-latest, < 2025.12.1", "status": "affected"}, {"version": ">= 2026.1.0-latest, < 2026.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-28T19:29:11.123Z"}, "descriptions": [{"lang": "en", "value": "Discourse is an open source discussion platform. A vulnerability present in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 affects anyone who uses S3 for uploads. While scripts may be executed, they will only be run in the context of the S3/CDN domain, with no site credentials. Versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 fix the issue. As a workaround, disallow html or xml files for uploads in authorized_extensions. For existing html xml uploads, site owners can consider deleting them."}], "source": {"advisory": "GHSA-68jp-3934-62rx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-28T18:28:39.719089Z", "id": "CVE-2025-66488", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T18:28:50.363Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-66488", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T18:28:39.719089Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T18:28:41.609Z"}}], "cna": {"title": "Discourse allows script execution in uploaded HTML/XML files on S3", "source": {"advisory": "GHSA-68jp-3934-62rx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "discourse", "product": "discourse", "versions": [{"status": "affected", "version": "< 3.5.4"}, {"status": "affected", "version": ">= 2025.11.0-latest, < 2025.11.2"}, {"status": "affected", "version": ">= 2025.12.0-latest, < 2025.12.1"}, {"status": "affected", "version": ">= 2026.1.0-latest, < 2026.1.0"}]}], "references": [{"url": "https://github.com/discourse/discourse/security/advisories/GHSA-68jp-3934-62rx", "name": "https://github.com/discourse/discourse/security/advisories/GHSA-68jp-3934-62rx", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Discourse is an open source discussion platform. A vulnerability present in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 affects anyone who uses S3 for uploads. While scripts may be executed, they will only be run in the context of the S3/CDN domain, with no site credentials. Versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 fix the issue. As a workaround, disallow html or xml files for uploads in authorized_extensions. For existing html xml uploads, site owners can consider deleting them."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116: Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-28T19:29:11.123Z"}}}, "cveMetadata": {"cveId": "CVE-2025-66488", "state": "PUBLISHED", "dateUpdated": "2026-01-28T19:29:11.123Z", "dateReserved": "2025-12-02T22:44:04.706Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-28T18:15:52.902Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "discourse", "vendor": "discourse", "versions": [{"status": "affected", "version": "< 3.5.4"}, {"status": "affected", "version": ">= 2025.11.0-latest, < 2025.11.2"}, {"status": "affected", "version": ">= 2025.12.0-latest, < 2025.12.1"}, {"status": "affected", "version": ">= 2026.1.0-latest, < 2026.1.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*", "matchCriteriaId": "FDBF21E2-1191-4020-A17A-0702DE4E6451", "versionEndExcluding": "3.5.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*", "matchCriteriaId": "539B5B85-44F0-408E-B994-08BB20EA9C26", "versionEndExcluding": "2025.11.2", "versionStartIncluding": "2025.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:discourse:discourse:2025.12.0:*:*:*:stable:*:*:*", "matchCriteriaId": "CCBF47A8-0D3F-4174-8084-CD3517BF272A", "vulnerable": true}, {"criteria": "cpe:2.3:a:discourse:discourse:2026.1.0:*:*:*:stable:*:*:*", "matchCriteriaId": "F6CF5F98-F08F-4B28-BBE2-8296760A547E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Discourse is an open source discussion platform. A vulnerability present in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 affects anyone who uses S3 for uploads. While scripts may be executed, they will only be run in the context of the S3/CDN domain, with no site credentials. Versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 fix the issue. As a workaround, disallow html or xml files for uploads in authorized_extensions. For existing html xml uploads, site owners can consider deleting them."}, {"lang": "es", "value": "Discourse es una plataforma de discusi\u00f3n de c\u00f3digo abierto. Una vulnerabilidad presente en versiones anteriores a 3.5.4, 2025.11.2, 2025.12.1 y 2026.1.0 afecta a cualquiera que use S3 para cargas. Aunque se pueden ejecutar los scripts, solo se har\u00e1 en el contexto del dominio S3/CDN, sin credenciales del sitio. Las versiones 3.5.4, 2025.11.2, 2025.12.1 y 2026.1.0 solucionan el problema. Como soluci\u00f3n alternativa, se recomienda no permitir archivos html o xml para cargas en authorized_extensions. Para las cargas existentes de html xml, los propietarios del sitio pueden considerar eliminarlas."}], "id": "CVE-2025-66488", "lastModified": "2026-06-17T09:56:55.357", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66488", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-28T18:28:39.719089Z", "version": "2.0.3"}}]}, "published": "2026-01-28T19:16:22.453", "references": [{"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/discourse/discourse/security/advisories/GHSA-68jp-3934-62rx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2026-01-29T09:08:39.534922+00:00", "updated": "2026-01-29T09:08:39.534947+00:00", "vendors": ["discourse", "discourse$PRODUCT$discourse"]}