Field notes: rebuild Discourse after the HEIF advisory

Scope

Defensive rebuild notes for operators who self-host Discourse. No vulnerability reproduction. Primaries: GHSA-vhm9-85gw-x335 and the patch callout in Hacktron's post.

Why a rebuild

The advisory ties RCE risk to upstream libheif inside the Discourse Docker image used for HEIF uploads. Updating Discourse application code through the web UI may leave the container's system packages unchanged. The documented remedy is to rebuild the app container so it includes the patched decoder. Newer supported core versions also add image-processing sandboxing as defense in depth.

Operator steps

1. Confirm you self-host (Discourse-hosted SaaS was already patched per the advisory).
2. Schedule a maintenance window. Rebuilds restart the app container.
3. On the host, from the Discourse install directory (commonly /var/discourse):
   • git pull
   • ./launcher rebuild app
4. After rebuild, confirm the running image matches a patched Discourse version listed on the GHSA (examples listed: 2026.7.0, 2026.6.1, 2026.5.2, 2026.1.6).
5. If you terminate TLS or run object storage in front of uploads, keep those controls; they do not replace the decoder patch.
6. Review whether HEIF/AVIF uploads are required. If not, tighten ImageMagick/policy allowlists as defense in depth (Hacktron points at ImageMagick security policy docs for format restriction).

Verification ideas (non-exploit)

• Record pre/post container image IDs and package versions for libheif in your change ticket.
• Confirm upload of a benign HEIF still works if you need the format; confirm non-image uploads still behave.
• Watch error logs during the first upload spike after rebuild.

What these notes are not

These notes are a rebuild checklist only. They omit PoCs, heap-corruption walkthroughs, and attack guidance. For the OpenAI SSO narrative that used a Discourse instance as one step, see the separate investigation and dispatch. Identity issues are outside this rebuild checklist.