Issue Description During a security assessment of our customized Discourse deployment, we discovered a potential directory traversal vulnerability related to the /uploads/* endpoint. Problem Details Accessing /uploads/ allows users to fetch files from arbitrary upload directories by manipulating the URL path. For example, it’s possible to traverse and access files across different upload directories that should be logically separated or protected. This behavior could allow unauthorized users to access sensitive files or attachments not intended for them, which poses a security risk. Example Suppose user A uploads a file in their private messages (or another restricted context). An attacker can craft a URL such as: https:///uploads/default/original/1X/../../another_directory/secret_file.jpg This allows the attacker to traverse up the directory tree and access files in other directories. Security Impact Unauthorized disclosure of private, internal, or otherwise restricted files Possible escalation depending on file content Questions / Feedback Sought Is this expected behavior in the current upload implementation? Are there any recommended configurations or patches to prevent directory traversal in /uploads/? Has this issue been discussed or mitigated in upstream Discourse? Do you have guidance for further securing file access in Discourse deployments? Thank you for your attention and feedback on this potential issue.

Potential Directory Traversal: /uploads/* allows cross-directory file access

Moin July 8, 2025, 10:42am 2

Topic		Replies	Views
Potential resource exhaustion: No rate limiting on /uploads.json allows mass file uploads Product Support uploads	0	130	July 8, 2025
Personal Message attachments accessible to unauthenticated users (missing auth check) Product Support secure-uploads , personal-messages	1	176	July 8, 2025
Does anyone have some suggestions how should I go about investigating Discourse losing old uploads? Product Support	0	58	July 4, 2024
Understanding Uploads, Images, and Attachments Site Management explanation , file-management	5	7009	January 15, 2025
Secure Uploads Announcements secure-uploads	43	18715	July 24, 2025