CVE-2026-70592 Details
Description
Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path separators in the caller-supplied filename. This issue is fixed in version 6.54.1.
A path traversal vulnerability has been identified in Ghost, a Node.js content management system, affecting versions 1.20.1 prior to 6.54.1. An Administrator-level user could remotely overwrite certain files on the filesystem by manipulating the database backup filename. This issue arose because the database export endpoint did not properly validate path separators in user-supplied filenames, leading to potential integrity and availability problems. The vulnerability has been patched in Ghost version 6.54.1.
Users can update to Ghost version 6.54.1, which includes the necessary fix. For self-hosters using Docker, instructions for updating a Docker-based Ghost instance are available in the Ghost documentation. If Ghost was installed using Ghost-CLI, guidance on updating to the latest version can also be found in the official documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 4, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TryGhost/Ghost/commit/f466c300191a609ed36c8d7c5d1e33ccd440786b | [email protected] | Source CodeVendor |
| https://github.com/TryGhost/Ghost/releases/tag/v6.54.1 | [email protected] | Release NotesVendor |
| https://github.com/TryGhost/Ghost/security/advisories/GHSA-cj62-hvv2-2q5h | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Ghost | >= 1.20.1, < 6.54.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |