CVE-2025-22601 LOW

CVE-2025-22601: Client Side Path Traversal using activate account route in Discourse

Vendor Discourse
Product discourse
Weakness CWE-22 · Path traversal
Published February 4, 2025
Last update February 11, 2025
View on NVD All CVEs

CVSS base score

3.1/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Discourse is an open source platform for community discussion. In affected versions an attacker can trick a target user to make changes to their own username via carefully crafted link using the `activate-account` route. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Key dates

02Disclosure timeline

February 4, 2025 CVE published
February 11, 2025 Record updated