CVE-2026-103290: Ghost CMS Path Traversal Vulnerability

CVE-2026-103290 Overview

CVE-2026-103290 is a path traversal vulnerability [CWE-35] in the Ghost publishing platform. The flaw affects Ghost versions 6.14.0 through versions prior to 6.27.0. The ImageSize service performs insufficient validation of user-supplied file paths. Authenticated staff users can abuse the flaw to read local files outside the intended data storage directories. The issue is tracked in GitHub Security Advisory GHSA-83rp-q473-j88c.

Critical Impact
Authenticated staff users can read arbitrary files on the Ghost server outside the designated content directories, exposing configuration data, credentials, and other sensitive host files.

Affected Products

Ghost 6.14.0
Ghost versions after 6.14.0 and prior to 6.27.0
Ghost self-hosted deployments running the vulnerable ImageSize service

Discovery Timeline

2026-10-01 - CVE-2026-103290 published to NVD
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-103290

Vulnerability Analysis

The vulnerability resides in Ghost's ImageSize service, which resolves and inspects image files referenced by staff users. The service accepts file paths supplied through authenticated API interactions and reads them from the local filesystem. Because input validation does not constrain paths to the designated content and image storage directories, the service can be coerced into reading files from arbitrary locations on the server.

The issue is classified as a Path Traversal weakness that leverages path equivalence through variant characters. An authenticated attacker with staff privileges can submit crafted path values that resolve outside the intended root. Successful exploitation returns metadata or content derived from those files to the attacker. Impacted assets include application configuration, environment files, and other readable data owned by the Ghost process user.

Root Cause

The root cause is missing canonicalization and allow-list enforcement on file path inputs processed by the ImageSize service. Ghost does not restrict path resolution to the configured content storage directories before performing filesystem reads.

Attack Vector

Exploitation requires network access to the Ghost admin API and valid staff-level credentials. The attacker submits a request that triggers ImageSize processing on a path containing traversal sequences or path aliasing. The service resolves the path and reads the target file. No user interaction is required, and the attack complexity is low. See the GitHub Security Advisory GHSA-83rp-q473-j88c and the VulnCheck Advisory for Ghost Path Traversal for additional technical context.

Detection Methods for CVE-2026-103290

Indicators of Compromise

Admin API requests referencing image paths that contain traversal sequences such as ../ or encoded variants targeting the ImageSize endpoint.
Ghost application logs showing filesystem reads outside the configured content/ directory tree.
Staff user sessions issuing anomalous volumes of image metadata requests against unusual path values.

Detection Strategies

Inspect reverse proxy and application access logs for requests to image-related endpoints that include path traversal patterns in query strings or JSON bodies.
Correlate authenticated staff account activity with filesystem audit events to identify reads of files outside Ghost's content root.
Alert on process-level file access by the Ghost Node.js process to paths such as /etc/, /root/, or application config directories.

Monitoring Recommendations

Enable verbose request logging for the Ghost admin API and retain logs for retrospective hunting against staff account activity.
Monitor for new or unexpected staff user creations, since staff-level credentials are the prerequisite for exploitation.
Track outbound data volumes from the Ghost host to detect bulk exfiltration following successful file reads.

How to Mitigate CVE-2026-103290

Immediate Actions Required

Upgrade Ghost to version 6.27.0 or later, which contains the fix referenced in GHSA-83rp-q473-j88c.
Audit all staff user accounts and remove or disable unused or stale accounts to reduce the pool of credentials that could be abused.
Rotate secrets, API keys, and database credentials that may have been exposed through filesystem reads if exploitation is suspected.

Patch Information

Ghost addressed the vulnerability in version 6.27.0. Administrators should upgrade self-hosted deployments following the project's standard upgrade procedure. Ghost(Pro) hosted instances are maintained by the vendor. Refer to the GitHub Security Advisory GHSA-83rp-q473-j88c for the authoritative fix reference.

Workarounds

Restrict administrative panel access by placing the Ghost admin interface behind a VPN or IP allow-list until the upgrade is applied.
Enforce strong authentication, including enabling two-factor authentication, on all staff accounts to raise the bar for credential compromise.
Run the Ghost process under a dedicated low-privilege user with filesystem permissions scoped tightly to the Ghost content directory.

bash

# Verify installed Ghost version and upgrade to the fixed release
ghost version
ghost update 6.27.0