VYPR
← All advisories
Medium severity6.8NVD Advisory· Published Oct 1, 2025· Updated Jun 17, 2026

CVE-2025-59337

CVE-2025-59337

Description

Discourse is an open-source community discussion platform. In versions 3.5.0 and below, malicious meta-commands could be embedded in a backup dump and executed during restore. In multisite setups, this allowed an admin of one site to access data or credentials from other sites. This issue is fixed in version 3.5.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • Discourse (software)/Discourse5 versions
    cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*+ 4 more
    • cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*range: <3.6.0
    • cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*range: <3.5.1
    • cpe:2.3:a:discourse:discourse:3.6.0:beta1:*:*:beta:*:*:*
    • (no CPE)range: <=3.5.0
    • (no CPE)range: < 3.5.1
  • osv-coords
    pkg:bitnami/discourse
    Range: < 3.5.1

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.