Ghost: Path Traversal Vulnerability in Ghost ImageSize Service
Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0.
01
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-105683US | — | — | ||
Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data stora… | ||||
| CVE-2026-103290US | low3.8 | — | ||
Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths ma… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/TryGhost/Ghost/commit/770d438fd9d352bbfccbe81dd890580a1d3fd6f0WEB
- https://github.com/TryGhost/Ghost/pull/27217WEB
- https://github.com/TryGhost/Ghost/releases/tag/v6.27.0WEB
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-83rp-q473-j88cWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-105683WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan