DISCOURSE IMAGEMAGICK VULNERABILITY ENABLES ARBITRARY FILE READ THROUGH MALICIOUS IMAGE UPLOADS

Summary from the TLDR InfoSec newsletter

Security researchers disclosed CVE-2026-55420, a critical vulnerability in Discourse enabling arbitrary file read and write operations through malicious image uploads. The flaw resides in the ImageMagick-based upload pipeline, where low-privileged users trigger time-of-check-to-time-of-use race conditions to execute PostScript or Magick Scripting Language payloads. Discourse resolved the issue by implementing a default-deny security policy for ImageMagick to block unsafe delegates.