p PatchFirst

CVE-2026-70592

CVE-2026-70592 · Ghost: Database Backup Path Traversal

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path separators in the caller-supplied filename. This issue is fixed in version 6.54.1.

CVSS 5.5 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • ghost

    Versions
    • >= 1.20.1, < 6.54.1: Affected

    No fix published

  • ghost npm

    Affected ranges
    • SEMVER: ≥ 1.20.1, < 6.54.1

    Update to 6.54.1

Original sources

Check your server →