CVE-2025-68662

CRITICAL 9.9CVE-2025-68662 · Published 28/01/2026 · updated 17/06/2026

In short

CVE-2025-68662 is a CRITICAL (CVSS 9.9) vulnerability affecting discourse (discourse).
Chance of exploitation in the next 30 days (EPSS): 0.33%, higher than 25.8% of all vulnerabilities.
Fix: update to 2025.11.2, 3.5.4 or later.

Package	Affected versions	Patched versions
discourse discourse	`= 2025.12.0= 2026.1.0≥ 2025.11.0, < 2025.11.2< 3.5.4`	`2025.11.23.5.4`

Description

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, a hostname validation issue in FinalDestination could allow bypassing SSRF protections under certain conditions. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.

References

discourse/discourse security advisory · Third Party Advisory

More vulnerabilities in discourse

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

discourse

= 2025.12.0= 2026.1.0≥ 2025.11.0, < 2025.11.2< 3.5.4

2025.11.23.5.4

Description

More vulnerabilities in discourse

See all →