Discourse CVE-2026-55420 ImageMagick Race Condition Enables File Read

Discourse suffers from a time-of-check-to-time-of-use race condition in its image upload pipeline, tracked as CVE-2026-55420. According to GBHackers, this vulnerability allows low-privileged users to read and write files on the underlying server. The issue stems from unsafe interactions between upload validation and ImageMagick processing components.

Root cause

The vulnerability arises because Discourse checks if an upload is a supported image based on filename or type detection. Supported extensions include JPEG, PNG, GIF, SVG, WebP, AVIF, HEIC, and JPEG XL. However, the workflow later invokes ImageMagick’s convert utility on a temporary path that retains the attacker-controlled file extension. This discrepancy allows malicious content to bypass initial checks.

Attack path

Researchers from Searchlight Cyber, led by Kevin Gervot, demonstrated the exploit using polyglot files. They combined JPEG XL structures with PostScript content to pass image checks while reaching ImageMagick and Ghostscript paths. The attack leverages ImageMagick’s MSL capabilities to read local paths. A specially crafted JPEG file prolongs the jpegoptim stage, widening the window for atomic file replacement.

Affected versions

• Default Discourse deployments using its Docker-based stack are affected.
• The vulnerability requires only a Trust Level 0 account, the platform’s lowest user privilege tier.
• Hosted customers received a fix in June 2026.
• Public disclosure occurred on June 30, 2026.

Mitigation

• Apply the patch released for hosted customers in June 2026.
• Ensure your Discourse instance is updated to the latest stable version.
• Monitor server logs for unusual file access or ImageMagick activity.
• Restrict upload permissions to trusted users where possible.

What to do and how to stay safe: Discourse

• Check your Discourse version against the vendor's advisory list for CVE-2026-55420.
• Review server file permissions to limit potential damage from arbitrary file reads.
• Monitor upload logs for unusual file types or repeated failed processing attempts.
• Once the vendor provides an update for self-hosted instances, apply it immediately.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-55420?

It is a critical vulnerability in Discourse that allows low-privileged users to read and write server files through a race condition in the image upload pipeline.

Who can exploit this vulnerability?

Any user with a Trust Level 0 account, which is the lowest privilege tier on the Discourse platform, can potentially exploit this flaw.

Is there a fix available?

Yes, the issue was fixed for hosted customers in June 2026. Self-hosted administrators should update their instances to the patched version.