by Kastro
Paper/Archive/CVE-2025-68662

CVE-2025-68662

discourse discourse — FinalDestination hostname matching allows SSRF protection bypass

EPSS 0.3%CVSS 9.9
critical.is priorityof 100
35
CVSS 9.9 (NVD)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 25.8.258 × 205.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, a hostname validation issue in FinalDestination could allow bypassing SSRF protections under certain conditions. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.

Affected

ProductAffectedFixed inSource
discourse< 3.5.4–CNA
discourse>= 2025.11.0-latest, < 2025.11.2–CNA
discourse>= 2025.12.0-latest, < 2025.12.1–CNA
discourse>= 2026.1.0-latest, < 2026.1.0–CNA

Scores by source

NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
GitHub_M (CNA)7.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/discourse/discourse/security/advisories/GHSA-gcfp-rjfc-925c