CVE-2026-70593: Path Traversal and Arbitrary File Write via Custom Theme Upload in Ghost CMS
Vulnerability ID: CVE-2026-70593
CVSS Score: 6.6
Published: 2026-08-04
CVE-2026-70593 is a path traversal and arbitrary file write vulnerability affecting Ghost CMS. Versions from 0.10.0 up to 6.54.0 are vulnerable. Authenticated administrators can exploit this flaw by uploading a custom theme in a ZIP archive that contains path traversal characters. The vulnerability is mitigated in version 6.54.1.
TL;DR
A path traversal flaw in Ghost CMS theme extraction allows authenticated users with administrative privileges to write arbitrary files to the local file system using crafted ZIP archives.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-22
- Attack Vector: Network
- CVSS Score: 6.6 (Medium)
- EPSS Score: N/A
- Exploit Status: PoC available, no active in-the-wild exploitation observed
- KEV Status: Not Listed
Affected Systems
- Ghost CMS (Self-hosted instances)
-
Ghost: >= 0.10.0, < 6.54.1 (Fixed in:
6.54.1)
Code Analysis
Commit: fbaa923
Ensure files are saved under the target directory and reject malformed theme names containing path elements.
Mitigation Strategies
- Upgrade Ghost CMS to version 6.54.1 or higher.
- Enforce least-privilege system permissions for the Ghost server process.
- Limit user permissions to restrict theme uploads to highly trusted administrators.
Remediation Steps:
- Access the local hosting environment of your Ghost installation.
- Create a full backup of the system configuration, database, and content files.
- Run the upgrade command: 'ghost update' to patch the installation to 6.54.1 or higher.
- Verify that the active Ghost service processes run under a dedicated, unprivileged system user.
References
Read the full report for CVE-2026-70593 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)