Vulnerability · Published Aug 4, 2026 · Assigned by GitHub_M

CVE-2026-70593Ghost: Theme Upload Path Traversal

Medium 6.6

In plain English

A medium-severity path traversal in Ghost from TryGhost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.6Medium

Exploit odds (30 days)0.4%top 64.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBase and theme storage name handling. This issue is fixed in version 6.54.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	ghost	6.54.1	GHSA-cjc9-q5gf-327p

Affected products (as reported)

Vendor	Product	Versions
TryGhost	Ghost	>= 0.10.0, < 6.54.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:L

References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-cjc9-q5gf-327p x_refsource_CONFIRM
https://github.com/TryGhost/Ghost/commit/fbaa92327e52607036a1e42204c9eadcc751d82c x_refsource_MISC
https://github.com/TryGhost/Ghost/releases/tag/v6.54.1 x_refsource_MISC