CVE-2026-70593: Ghost Theme Upload Path Traversal Vulnerability
Summary
CVE-2026-70593: Ghost: Theme Upload Path Traversal. Affects ghost versions >= 0.10.0, < 6.54.1. Fixed in 6.54.1. How to fix ↓
Also tracked for
- ghost · npm
The same CVE-2026-70593 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular Node.js content management system designed for professional publishing. It allows users to create and manage content with ease, featuring a simple interface and powerful customization options through themes and plugins. However, versions from 0.10.0 to 6.54.1 are vulnerable to a specific issue that allows unauthorized file writing outside the designated uploads directory, posing a risk to the integrity of the installation.
Vulnerability Detail
The vulnerability arises from improper handling of custom theme uploads in Ghost, specifically in the LocalStorageBase and theme storage name management. This flaw enables a staff user to exploit the theme upload functionality, allowing them to write files outside the intended uploads directory. The ramifications include potential alteration of the Ghost installation's behavior, which could lead to unauthorized access or data manipulation.
How To Fix
Minimum fixed version
6.54.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, restrict staff user permissions to prevent theme uploads until the Ghost installation can be updated. This can be done by adjusting user roles in the Ghost admin panel.
Conclusion
The Ghost theme upload path traversal vulnerability (CVE-2026-70593) poses a significant risk to installations from versions 0.10.0 to 6.54.1. Users are strongly advised to update to version 6.54.1 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in open-source projects effectively.
See every vulnerability recorded for ghost →
FAQ
Versions from 0.10.0 to 6.54.1 are affected by this vulnerability.
The vulnerability allows unauthorized file writing, which could lead to data manipulation or unauthorized access to the Ghost installation.
You can check your Ghost version in the admin panel or by running 'ghost version' in the terminal.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using a manifest file like package-lock.json.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
