Vulnerability Description
Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBase and theme storage name handling. This issue is fixed in version 6.54.1.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/TryGhost/Ghost/commit/fbaa92327e52607036a1e42204c9eadcc751d82
- https://github.com/TryGhost/Ghost/releases/tag/v6.54.1
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-cjc9-q5gf-327p
FAQ
What is CVE-2026-70593?
CVE-2026-70593 is a vulnerability with a CVSS score of 6.6 (MEDIUM). Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alt...
How severe is CVE-2026-70593?
CVE-2026-70593 has been rated MEDIUM with a CVSS base score of 6.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-70593?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.