Threat reportVulnerabilityTL-2026-3329
Discourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for Arbitrary File Read (CVE-2026-55420)
Discourse Image Pipeline Exploit Chains JPEG Race (TL-2026-3329), also tracked as A JPEG, a Race, and a Ghost, is a high-severity software vulnerability scored CVSS 7.5, first published 2026-10-12. It has no confirmed attribution, affects Discourse Discourse, references 2 CVEs (CVE-2026-55420, CVE-2026-55674), maps to 6 MITRE ATT&CK techniques (T1005, T1036.008, T1059), and is covered by 9 detection rules and 7 indicators of compromise.
- CVSS
- 7.5/10High
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-3329
- Threat ID
- TL-2026-3329
- Also known as
- A JPEG, a Race, and a Ghost
- Severity
- HIGH
- CVSS
- 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, education, non-profit organisation, software-vendors, online-communities
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in Discourse Image Pipeline Exploit Chains JPEG Race
Malware and tooling: Ghostscript, ImageMagick
How Discourse Image Pipeline Exploit Chains JPEG Race works
Searchlight Cyber researcher Kevin Gervot chained a JPEG-bomb processing delay, a TOCTOU race between FastImage validation and ImageMagick processing, a JXL/PostScript polyglot executed by Ghostscript, and ImageMagick's MSVG/MSL coder to read local files from Discourse using only a Trust Level 0 account. The flaw was patched before public disclosure; full technical details are public.
CVE-2026-55420 affects Discourse's server-side image-processing pipeline. Searchlight Cyber's research ("A JPEG, a Race, and a Ghost") describes an exploit chain with three cooperating components. First, a 236KB JPEG using libjpeg APP-marker padding stalls the jpegoptim optimize step for roughly 25 seconds, widening a race window. Second, a TOCTOU race exists between the FastImage validation / extract_image_info step and the later ImageMagick dominant_color step: a file uploaded with a .msvg extension and valid JPEG content is swapped for attacker-controlled SVG/MSL content after validation but before processing. Third, a polyglot that begins with a JPEG XL header whose bytes double as a PostScript comment (0x25 '%') and carries valid dimensions in a jxlc box passes FastImage, is uploaded with a .pdf extension, and is handed by ImageMagick's dominant_color to Ghostscript even though the PS coder is blocked by policy. The PostScript uses the renamefile operator (an atomic POSIX rename) to replace the victim temp file, making the race timing non-critical.
Once the replacement file is processed under the .msvg (or .msvg.gz, to bypass libxml2 null-byte encoding detection) name, ImageMagick's internal MSVG coder and MSL (Magick Scripting Language) are reached. An MSL payload such as <read filename="label:@/etc/passwd"/><write filename="/tmp/exfil.png"/> renders local file contents into an image; a second iteration copies the output over the victim temp file so it is stored as a normal upload whose URL is returned to the attacker. The result is arbitrary local file disclosure, not full server code execution, and the minimum privilege is Trust Level 0 (profile-picture upload) per the researchers, in default configuration per the press coverage.
Note on severity sources: the official GitHub advisory GHSA-7wq5-jgww-5rw3 (published 2026-06-30) and NVD/OSV describe the same CVE as remote code execution via PDF uploads under non-default configuration, CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), CWE-78, with the workaround of removing .pdf from allowed upload extensions. The researchers' write-up demonstrates file read; the vendor rating reflects the broader potential of Ghostscript PostScript execution. No in-the-wild exploitation has been reported.
The same research reports a separate, distinct flaw, CVE-2026-55674 (CVSS 9.3 per aggregators): an unescaped color_scheme_id / dark_scheme_id cookie was interpolated into HTML and the anonymous-cache key omitted that cookie, so one unauthenticated request could poison the shared cache. A selector-hijack gadget (link[rel=modulepreload][data-plugin-name] processed by Discourse's boot script) bypassed the nonce-based strict-dynamic CSP and gave sitewide JavaScript execution for anonymous visitors. It was fixed in 2026.1.6, 2026.5.2, 2026.6.1 and 2026.7.0 with strict integer validation and adding the cookie to the cache key. Discourse reportedly powers 22,000+ communities.
MITRE ATT&CK techniques used in TL-2026-3329
Collection
Defense Evasion
T1036.008 Masquerade File Type
Execution
T1059 Command and Scripting Interpreter; T1059.007 JavaScript
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Affected products and versions in Discourse Image Pipeline Exploit Chains JPEG Race
- Discourse — Discourse
Vulnerable versions: 2026.1.0 - 2026.1.4; 2026.4.0 - 2026.4.1; 2026.5.0
Fixed in: 2026.1.5; 2026.4.2; 2026.5.1; 2026.6.0
Remediation for Discourse Image Pipeline Exploit Chains JPEG Race
Patches
- Discourse 2026.6.0, 2026.5.1, 2026.4.2, 2026.1.5 (CVE-2026-55420, commit ca5a7e06167561928556afa2f237d67e459c6914)
- Discourse 2026.7.0, 2026.6.1, 2026.5.2, 2026.1.6 (CVE-2026-55674)
Immediate actions
- Upgrade Discourse to 2026.6.0, 2026.5.1, 2026.4.2 or 2026.1.5 or later; for the color scheme cookie flaw use 2026.7.0, 2026.6.1, 2026.5.2 or 2026.1.6
- Remove .pdf from the allowed upload file extensions list until patched
- Review uploads from low-trust (TL0) accounts, especially .pdf/.msvg/.msvg.gz names containing JPEG or JXL content
Workarounds
- Remove .pdf from the allowed upload extensions list (vendor workaround, GHSA-7wq5-jgww-5rw3)
Longer-term hardening
- Adopt a default-deny ImageMagick policy.xml that blocks all delegates and allowlists only required coders
- Remove or sandbox Ghostscript from image-processing hosts and containers
- Run image processing in an isolated, least-privilege container with no access to application secrets
CVEs associated with Discourse Image Pipeline Exploit Chains JPEG Race
Weaknesses (CWE) in Discourse Image Pipeline Exploit Chains JPEG Race
Timeline of Discourse Image Pipeline Exploit Chains JPEG Race
- Searchlight Cyber reports the image-pipeline chain to the Discourse security team.
- Discourse confirms the report and deploys patches to hosted customers.
- ImageMagick-related fix released publicly in 2026.6.0, 2026.5.1, 2026.4.2 and 2026.1.5; GHSA-7wq5-jgww-5rw3 published.
- CVE-2026-55420 published (CVSS 3.1 7.5 High, CWE-78) describing RCE via PDF uploads under non-default configuration.
- Fix for the separate color scheme cookie cache poisoning/XSS flaw (CVE-2026-55674) released publicly.
- Searchlight Cyber technical write-up and press coverage detail the full file-read exploit chain; no in-the-wild exploitation reported.
Sources cited for Discourse Image Pipeline Exploit Chains JPEG Race
- Discourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for File Read
- Searchlight Cyber: A JPEG, a Race, and a Ghost - Breaking Discourse's Image Pipeline
- GitHub Security Advisory GHSA-7wq5-jgww-5rw3: Discourse RCE via PDF uploads
- NVD: CVE-2026-55420
- OSV: CVE-2026-55420
- Vulert: CVE-2026-55420 Discourse Remote Code Execution via PDF Uploads
- Averlon: CVE-2026-55674 Discourse cache poisoning/XSS via color scheme cookies
- Discourse patch commit for CVE-2026-55420
Detection coverage for TL-2026-3329
As of 2026-10-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3329 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.