CVE-2026-70593

Received Received - Intake

Ghost CMS Theme Upload Path Traversal Vulnerability

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBase and theme storage name handling. This issue is fixed in version 6.54.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-04

Generated

2026-08-05

AI Q&A

2026-08-05

EPSS Evaluated

N/A

NVD

CVE-2026-70593

Affected Vendors & Products

Vendor	Product	Version / Range
ghost	ghost	From 0.10.0 (inc) to 6.54.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability affects Ghost, a Node.js content management system. It allows a staff user with limited privileges to upload custom themes that write files outside the intended uploads directory. By exploiting path traversal in theme storage handling, an attacker could manipulate files to alter the system's behavior.

Impact Analysis

If exploited, this vulnerability could let an attacker modify critical files on your Ghost installation. This might disrupt services, alter site functionality, or enable further attacks. Staff users with limited access could gain unintended control over the system.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized file writes outside designated directories. For GDPR, this may affect data integrity and security measures. For HIPAA, it could compromise protected health information if theme storage paths are manipulated.

Mitigation Strategies

Update Ghost to version 6.54.1 or later to patch the vulnerability. Review custom themes for unauthorized file modifications outside the uploads directory. Restrict staff user permissions to limit file system access.

Hi! I’m here to help you understand CVE-2026-70593. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70