# Discourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for Arbitrary File Read (CVE-2026-55420)

> Searchlight Cyber researcher Kevin Gervot chained a JPEG-bomb processing delay, a TOCTOU race between FastImage validation and ImageMagick processing, a JXL/PostScript polyglot executed by Ghostscript, and ImageMagick's MSVG/MSL coder to read local files from Discourse using only a Trust Level 0 account. The flaw was patched before public disclosure; full technical details are public.

- **Published:** 2026-10-12T06:58:05Z
- **Last reviewed:** 2026-10-12T06:58:05Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3329
- **ID:** TL-2026-3329
- **Severity:** HIGH (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-55420, CVE-2026-55674

## Description

CVE-2026-55420 affects Discourse's server-side image-processing pipeline. Searchlight Cyber's research ("A JPEG, a Race, and a Ghost") describes an exploit chain with three cooperating components. First, a 236KB JPEG using libjpeg APP-marker padding stalls the jpegoptim optimize step for roughly 25 seconds, widening a race window. Second, a TOCTOU race exists between the FastImage validation / extract_image_info step and the later ImageMagick dominant_color step: a file uploaded with a .msvg extension and valid JPEG content is swapped for attacker-controlled SVG/MSL content after validation but before processing. Third, a polyglot that begins with a JPEG XL header whose bytes double as a PostScript comment (0x25 '%') and carries valid dimensions in a jxlc box passes FastImage, is uploaded with a .pdf extension, and is handed by ImageMagick's dominant_color to Ghostscript even though the PS coder is blocked by policy. The PostScript uses the renamefile operator (an atomic POSIX rename) to replace the victim temp file, making the race timing non-critical.

Once the replacement file is processed under the .msvg (or .msvg.gz, to bypass libxml2 null-byte encoding detection) name, ImageMagick's internal MSVG coder and MSL (Magick Scripting Language) are reached. An MSL payload such as <read filename="label:@/etc/passwd"/><write filename="/tmp/exfil.png"/> renders local file contents into an image; a second iteration copies the output over the victim temp file so it is stored as a normal upload whose URL is returned to the attacker. The result is arbitrary local file disclosure, not full server code execution, and the minimum privilege is Trust Level 0 (profile-picture upload) per the researchers, in default configuration per the press coverage.

Note on severity sources: the official GitHub advisory GHSA-7wq5-jgww-5rw3 (published 2026-06-30) and NVD/OSV describe the same CVE as remote code execution via PDF uploads under non-default configuration, CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), CWE-78, with the workaround of removing .pdf from allowed upload extensions. The researchers' write-up demonstrates file read; the vendor rating reflects the broader potential of Ghostscript PostScript execution. No in-the-wild exploitation has been reported.

The same research reports a separate, distinct flaw, CVE-2026-55674 (CVSS 9.3 per aggregators): an unescaped color_scheme_id / dark_scheme_id cookie was interpolated into HTML and the anonymous-cache key omitted that cookie, so one unauthenticated request could poison the shared cache. A selector-hijack gadget (link[rel=modulepreload][data-plugin-name] processed by Discourse's boot script) bypassed the nonce-based strict-dynamic CSP and gave sitewide JavaScript execution for anonymous visitors. It was fixed in 2026.1.6, 2026.5.2, 2026.6.1 and 2026.7.0 with strict integer validation and adding the cookie to the cache key. Discourse reportedly powers 22,000+ communities.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1059.007 JavaScript
- T1036.008 Masquerade File Type
- T1005 Data from Local System

## Sources

- [Discourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for File Read](https://cybersecuritynews.com/discourse-image-pipeline-exploit/)
- [Searchlight Cyber: A JPEG, a Race, and a Ghost - Breaking Discourse's Image Pipeline](https://slcyber.io/research/a-jpeg-a-race-and-a-ghost-breaking-discourses-image-pipeline)
- [GitHub Security Advisory GHSA-7wq5-jgww-5rw3: Discourse RCE via PDF uploads](https://github.com/discourse/discourse/security/advisories/GHSA-7wq5-jgww-5rw3)
- [NVD: CVE-2026-55420](https://nvd.nist.gov/vuln/detail/cve-2026-55420)
- [OSV: CVE-2026-55420](https://osv.dev/vulnerability/CVE-2026-55420)
- [Vulert: CVE-2026-55420 Discourse Remote Code Execution via PDF Uploads](https://vulert.com/vuln-db/CVE-2026-55420)
- [Averlon: CVE-2026-55674 Discourse cache poisoning/XSS via color scheme cookies](https://research.averlon.ai/vulnerability-intelligence/cve/CVE-2026-55674)
- [Discourse patch commit for CVE-2026-55420](https://github.com/discourse/discourse/commit/ca5a7e06167561928556afa2f237d67e459c6914)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3329