p PatchFirst

CVE-2026-103290

CVE-2026-103290 · Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended data storage directories on the server.

CVSS 5.1 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • ghost

    Versions
    • ≥ 6.14.0, < 6.27.0: Affected (semver)
    • 6.27.0: Not affected (semver)

    Update to 6.27.0

  • ghost npm

    Affected ranges
    • SEMVER: ≥ 6.14.0, < 6.27.0

    Update to 6.27.0

Original sources

Check your server →