CVE-2026-70593: Ghost Theme Upload Path Traversal Vulnerability
Summary
CVE-2026-70593: Ghost: Theme Upload Path Traversal. Affects ghost versions >= 0.10.0, < 6.54.1. Fixed in 6.54.1. How to fix ↓
Also tracked for
- ghost · Bitnami
The same CVE-2026-70593 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular open-source publishing platform designed for creating and managing online content. It offers a user-friendly interface, customizable themes, and a robust ecosystem for developers. However, certain versions of Ghost are vulnerable to a path traversal issue that allows unauthorized file writing outside the designated uploads directory.
Vulnerability Detail
The vulnerability arises from improper handling of custom themes, which permits a staff user to write files outside the intended uploads directory. This could lead to unauthorized modifications of the installation, potentially altering its behavior and compromising security. The issue affects versions from v0.10.0 up to v6.54.0, making it critical for users of these versions to take action.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.54.1
This is the first release that contains the fix.
npm install ghost@6.54.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version as soon as possible.
Conclusion
In summary, CVE-2026-70593 is a significant vulnerability in Ghost that allows unauthorized file writing, potentially compromising the installation. Users are urged to update to version 6.54.1 or later to mitigate this risk. Regular monitoring and updates are essential for maintaining security.
See every vulnerability recorded for ghost →
FAQ
The vulnerability allows a staff user to write files outside the uploads directory, which can compromise the installation.
The vulnerability affects Ghost versions from v0.10.0 up to v6.54.0.
You can check your Ghost version by accessing the admin panel or using the command line. Additionally, you can use Vulert's playground at Vulert Scanner to monitor for vulnerabilities.
The CVSS score for this vulnerability is 6.6, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just package-lock.json, ensuring you stay updated without needing to access the code.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
