ディレクトリトラバーサル: /uploads/* により、ディレクトリを跨いだファイルアクセスが可能

[Moin]

secure-uploads 機能に興味があるかもしれません。

Secure Uploads

Added in the Discourse 2.4 release in February is the Secure Uploads feature, which provides a higher degree of security for ALL uploads (images, video, audio, text, pdfs, zips, and others) within a Discourse instance. Prerequisites You must have S3 uploads enabled on your site, which needs the following settings to be filled: S3 access key id S3 secret access key S3 region S3 upload bucket You also must be using an S3 bucket that does not have a Public bucket policy, and you need to make su…