HackerOne Disclosed Reports - 2026-10-25

Medium
resolved

Arbitrary `/tmp` read in discourse via `convert_heif!` decoder-confusion (regression of 4bf3bf6786)

Bug reported by Tuan Nguyen was disclosed at October 26, 2026, 3:43 am   |   Information Disclosure

A decoder confusion vulnerability was discovered in image conversion functionality that allowed arbitrary file reads from temporary directories. When HEIF/HEIC files were processed, the conversion function failed to enforce a specific decoder prefix, allowing ImageMagick to dispatch based on file magic bytes instead of extension. Files with PostScript headers were routed through Ghostscript, which executed arbitrary PostScript code under a restricted sandbox. The PostScript was able to read temporary files, enumerate directory contents, and render the results into JPEG images that were stored as normal uploads and served publicly without authentication. This enabled authenticated users to exfiltrate temporary files from other users and system processes, including in-flight upload buffers, email attachments, and conversion intermediates. The vulnerability was introduced when HEIF support was added and represented a regression of previous security fixes that had enforced decoder specification.