CVE-2026-70592

Received Received - Intake

Ghost CMS Remote File Overwrite via Database Backup Filename

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description

Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path separators in the caller-supplied filename. This issue is fixed in version 6.54.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-04

Generated

2026-08-05

AI Q&A

2026-08-05

EPSS Evaluated

N/A

NVD

CVE-2026-70592

Affected Vendors & Products

Vendor	Product	Version / Range
ghost	ghost	From 1.20.1 (inc) to 6.54.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Ghost content management system. Between versions 1.20.1 and 6.54.1, an administrator could remotely overwrite files on the system by manipulating the database backup filename. The system failed to block path separators in filenames, allowing unauthorized file writes that could compromise integrity and availability.

Impact Analysis

An attacker with administrator access could overwrite critical files, potentially disrupting services or injecting malicious code. This could lead to data corruption, unauthorized access, or complete system compromise depending on which files are overwritten.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized file modifications, potentially exposing sensitive data or disrupting regulated services. GDPR and HIPAA require integrity and availability of data, which this flaw undermines.

Mitigation Strategies

Upgrade Ghost to version 6.54.1 or later to address the vulnerability. Review database backup filenames for suspicious path separators and restrict Administrator-level user access to prevent unauthorized file overwrites.

Hi! I’m here to help you understand CVE-2026-70592. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70