Executive brief
Ghost, a popular open-source content management system and publishing platform, is affected by a security flaw in its theme upload process. An authorized staff user could exploit this to save files in unauthorized locations on the server, potentially altering the website's behavior or compromising the underlying system. This could lead to unauthorized modifications of the site or impact the availability of the service.
Technical details
A path traversal vulnerability (CWE-22) exists in Ghost's theme upload mechanism within the LocalStorageBase component. The application fails to properly validate that the resolved path of an uploaded theme file remains within the designated 'uploads' or 'themes' directory. An attacker with 'staff' level privileges can provide a crafted filename containing traversal sequences (e.g., ../) to write arbitrary files to the filesystem. This exploit requires network access and high privileges but can result in a scope change, impacting the integrity of the host system. The issue is fixed in version 6.54.1 by implementing strict path prefix validation using path.resolve().
Affected products
- Ghost Foundation Ghost >= 0.10.0, < 6.54.1
Timeline
- 2026-07-27: patched: Version 6.54.1 released
- 2026-07-30: disclosed: Initial advisory publication
- 2026-08-04: advisory: GitHub Advisory reviewed and updated