CVE-2026-70592: CVE-2026-70592: Path Traversal Vulnerability in Ghost CMS Database Exporter

#security #cve #cybersecurity

CVE-2026-70592: Path Traversal Vulnerability in Ghost CMS Database Exporter

Vulnerability ID: CVE-2026-70592
CVSS Score: 5.5
Published: 2026-08-04

A path traversal vulnerability (CWE-22) in Ghost CMS versions 1.20.1 through 6.54.0 allows authenticated administrators to escape the backup directory and perform arbitrary file write operations on the hosting system. This vulnerability was resolved in version 6.54.1.

TL;DR

An authenticated path traversal vulnerability in Ghost CMS database export functionality allows arbitrary file writing on the server hosting the application, fixed in version 6.54.1.

Technical Details

CWE ID: CWE-22
Attack Vector: Network
CVSS v3.1 Score: 5.5
EPSS Score: N/A
Impact: Arbitrary File Write / Overwrite
Exploit Status: None / Conceptual
CISA KEV Status: Not Listed

Affected Systems

Ghost CMS
Ghost: >= 1.20.1, < 6.54.1 (Fixed in: 6.54.1)

Code Analysis

Commit: f466c30

Enforce path separator validation on database backup filename and apply path.basename to resolve custom backup files securely

Mitigation Strategies

Upgrade Ghost CMS to version 6.54.1 or later.
Set the environment variable disableJSBackups=true to disable the backup endpoint.
Implement strict least-privilege principles on the Ghost system service account.

Remediation Steps:

Check current Ghost version via command-line or administrative console.
Upgrade the deployment to version 6.54.1 using the standard update command.
Verify path traversal requests are blocked by testing against the updated API endpoint.
Optionally modify config.production.json to set disableJSBackups to true if upgrading cannot occur immediately.

References

Read the full report for CVE-2026-70592 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community