CVE-2026-103276
Received Received - Intake

Ghost CMS Theme Template File Disclosure via URL Encoding

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: VulnCheck

Description
Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers can use URL encoding to bypass extension validation and access sensitive theme files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-103276
EUVD
EUVD-2026-90669

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ghost ghost to 6.20.0 (exc)
tryghost ghost to 6.20.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-173 The product does not properly handle when an input uses an alternate encoding that is valid for the control sphere to which the input is being sent.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Ghost versions before 6.20.0 have a vulnerability where file extension filtering can be bypassed using URL encoding. This allows unauthenticated attackers to read theme templates and metadata, which are sensitive files. The issue arises from improper handling of alternate encoding methods.

Detection Guidance

To detect this vulnerability, check if your Ghost installation is running a version prior to 6.20.0. Use commands like 'ghost version' or check your package.json for the Ghost version. Inspect web server logs for unusual requests attempting to access theme files with encoded extensions.

Impact Analysis

Attackers could access theme templates and metadata without authentication, potentially exposing sensitive information. This could lead to data leaks, unauthorized modifications, or further exploitation of the Ghost instance.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Immediately update Ghost to version 6.20.0 or later. For Docker setups, pull the latest image and redeploy. For Ghost-CLI, run 'ghost update'. Verify the update by checking the version again. If updating is not possible, restrict access to theme directories via web server configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103276. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart