Executive brief
Ghost is a popular open-source content management system used for professional publishing and blogging. A security flaw in the database backup feature allows a user with Administrator-level privileges to overwrite files on the server's filesystem. This could lead to service disruptions or the corruption of critical system data.
Technical details
A path traversal vulnerability (CWE-22) exists in the database backup/export functionality of Ghost. The root cause is insufficient validation of the 'filename' parameter within the database API endpoint, allowing an attacker to use path separators to target locations outside the intended backup directory. An authenticated user with Administrator privileges can exploit this over the network to overwrite arbitrary files on the host filesystem. This can result in a loss of system integrity or a denial-of-service condition. The issue is fixed in version 6.54.1 by implementing stricter validation to ensure filenames do not contain path separators.
Affected products
- Ghost Foundation Ghost >= 1.20.1, < 6.54.1
Timeline
- 2026-07-27: patched: Version 6.54.1 released
- 2026-07-30: disclosed: Initial advisory publication
- 2026-08-04: advisory: GitHub Advisory Database entry updated