CVE-2026-70592

Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path separators in the caller-supplied filename. This issue is fixed in version 6.54.1.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/TryGhost/Ghost/commit/f466c300191a609ed36c8d7c5d1e33ccd440786b
https://github.com/TryGhost/Ghost/releases/tag/v6.54.1
https://github.com/TryGhost/Ghost/security/advisories/GHSA-cj62-hvv2-2q5h

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Ghost es un sistema de gestión de contenido Node.js. Desde 1.20.1 hasta 6.54.1, un usuario con nivel de Administrador podía sobrescribir remotamente ciertos archivos en el sistema de archivos a través del nombre de archivo de la copia de seguridad de la base de datos, lo que provocaba problemas de integridad y disponibilidad. El endpoint de exportación de la base de datos no pudo rechazar los separadores de ruta en el nombre de archivo proporcionado por el llamador. Este problema está solucionado en la versión 6.54.1.

Information

Published : 2026-08-04 22:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-70592

Mitre link : CVE-2026-70592

CVE.ORG link : CVE-2026-70592

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-70592", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70592", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T14:01:21.561748Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "TryGhost", "product": "Ghost", "versions": [{"status": "affected", "version": ">= 1.20.1, < 6.54.1"}]}]}], "published": "2026-08-04T22:17:17.140", "references": [{"url": "https://github.com/TryGhost/Ghost/commit/f466c300191a609ed36c8d7c5d1e33ccd440786b", "source": "security-advisories@github.com"}, {"url": "https://github.com/TryGhost/Ghost/releases/tag/v6.54.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-cj62-hvv2-2q5h", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path separators in the caller-supplied filename. This issue is fixed in version 6.54.1."}, {"lang": "es", "value": "Ghost es un sistema de gesti\u00f3n de contenido Node.js. Desde 1.20.1 hasta 6.54.1, un usuario con nivel de Administrador pod\u00eda sobrescribir remotamente ciertos archivos en el sistema de archivos a trav\u00e9s del nombre de archivo de la copia de seguridad de la base de datos, lo que provocaba problemas de integridad y disponibilidad. El endpoint de exportaci\u00f3n de la base de datos no pudo rechazar los separadores de ruta en el nombre de archivo proporcionado por el llamador. Este problema est\u00e1 solucionado en la versi\u00f3n 6.54.1."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "security-advisories@github.com"}