CVE-2025-59337: 
NixOS vulnerability analysis and mitigation

CVE-2025-59337 is a backup restore meta-command injection vulnerability in Discourse, an open-source community discussion platform. Malicious PostgreSQL meta-commands (e.g., \restrict, \unrestrict) could be embedded in a backup dump file and executed during the restore process. In multisite deployments, this allowed an administrator of one site to access data or credentials belonging to other sites sharing the same infrastructure. Affected versions include stable releases up to and including 3.5.0 and beta/tests-passed releases up to 3.6.0.beta1-dev. The vulnerability was published on September 30, 2025, and carries a CVSS v3.1 score of 6.8 (Medium) and a CVSS v4.0 score of 5.5 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is improper neutralization of special elements used in a command (CWE-77 — Command Injection). Discourse's backup restore process pipes a SQL dump through a sed filter to strip unwanted SQL statements before passing it to psql. However, the original implementation did not strip or sanitize PostgreSQL meta-commands such as \restrict and \unrestrict, which are interpreted directly by the psql client rather than the database engine. An attacker with admin privileges on one Discourse site in a multisite setup could craft a malicious backup dump containing these meta-commands, then trigger a restore operation to have them executed in the context of the shared psql session, potentially accessing other sites' schemas and credentials (GitHub Advisory, GitHub Commit).

Successful exploitation primarily impacts confidentiality in multisite Discourse deployments, with no direct availability impact. A malicious site administrator can access sensitive data and credentials from other sites sharing the same infrastructure, constituting a significant cross-site data breach. The CVSS v4.0 scoring reflects high subsequent-system confidentiality, integrity, and availability impact, underscoring the risk to co-hosted sites beyond the attacker's own instance (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. Exploitation requires high privileges (site administrator access) on a Discourse instance within a multisite deployment, limiting the attack surface. The EPSS score is approximately 0.043%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Gain admin access: Obtain administrator privileges on one Discourse site within a multisite deployment (e.g., through legitimate admin credentials or a separate compromise).
2. Craft malicious backup: Create or modify a PostgreSQL dump file to embed malicious psql meta-commands (e.g., \restrict or \unrestrict directives) that, when processed by the psql client during restore, alter session-level access controls or execute cross-schema queries.
3. Upload the backup: Use the Discourse admin backup interface to upload the crafted dump file to the target Discourse instance.
4. Trigger restore: Initiate a backup restore operation via the admin panel. The restore process pipes the dump through sed (which did not previously strip \restrict/\unrestrict commands) and into psql.
5. Access cross-site data: The injected meta-commands execute in the shared psql session, enabling the attacker to read data or credentials from other sites' database schemas within the same multisite infrastructure (GitHub Advisory, GitHub Commit).

• Logs: Discourse application logs showing backup restore operations initiated by an administrator, particularly on multisite deployments; PostgreSQL logs containing unexpected \restrict or \unrestrict meta-commands during restore sessions.
• File System: Presence of modified or externally sourced .sql backup dump files in the Discourse backup directory containing \restrict or \unrestrict directives not generated by standard pg_dump.
• Database: Unexpected cross-schema queries or access patterns in PostgreSQL audit logs originating from the Discourse restore process; unauthorized reads of credential tables from schemas belonging to other sites in a multisite setup.

Upgrade Discourse to version 3.5.1 (stable) or 3.6.0.beta2-dev (tests-passed) or later, which implement nonce-based restrictions during restore to prevent injection of arbitrary meta-commands. The fix adds \restrict and \unrestrict to the sed filter's blocklist and wraps the restore pipeline with a cryptographically random nonce, ensuring only trusted meta-commands are processed. No configuration-based workaround is available; upgrading is the only remediation. In multisite environments, administrators should also audit existing backup files for suspicious meta-commands before performing any restore operations (GitHub Advisory, GitHub Commit).