CVE-2026-104417: Ghost CMS Path Traversal Vulnerability

CVE-2026-104417 Overview

CVE-2026-104417 is a path traversal vulnerability [CWE-22] in Ghost, the open-source publishing platform. The flaw affects Ghost versions from 1.20.0 before 6.64.0 and resides in the theme translation file loading logic. Authenticated administrators can manipulate the locale setting to make Ghost load JSON files from directories outside the active theme folder. Successful exploitation exposes server configuration files and other JSON-formatted secrets available to the Ghost process. The vulnerability requires high privileges but no user interaction and is reachable over the network.

Critical Impact
Authenticated administrators can read arbitrary JSON files on the Ghost server, disclosing configuration secrets stored outside the theme directory.

Affected Products

Ghost versions 1.20.0 through 6.63.x
Fixed in Ghost 6.64.0
Self-hosted and custom Ghost deployments running vulnerable versions

Discovery Timeline

2026-10-02 - CVE-2026-104417 published to NVD
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-104417

Vulnerability Analysis

Ghost loads translation strings from JSON files inside the active theme directory, selecting the file based on the configured locale value. The translation loader concatenates the locale string into a filesystem path without normalizing or validating it against the theme root. An administrator can set the locale to a value containing path traversal sequences such as ../, redirecting the loader to JSON files elsewhere on the server. Because Ghost reads the resulting file and surfaces its content during translation processing, attackers can retrieve the contents of arbitrary JSON files readable by the Ghost process.

Targets of interest include config.production.json, service credential files, and other JSON secrets co-located with the Ghost installation. The vulnerability does not allow arbitrary file writes or code execution directly, but disclosed secrets can enable follow-on compromise of the database, mail provider, storage adapters, or integrated APIs.

Root Cause

The root cause is improper sanitization of the locale setting before it is used as part of a file path. The code trusts administrator-supplied input and does not confine the resolved path to the active theme directory, violating standard path containment practices described in CWE-22.

Attack Vector

An attacker with administrator credentials to the Ghost admin interface updates the site locale to a traversal payload. On the next request that triggers translation loading, Ghost opens the attacker-chosen JSON file and processes its content, leaking configuration data back through the application. See the GitHub Security Advisory and the VulnCheck Advisory on Ghost Vulnerability for vendor details.

Detection Methods for CVE-2026-104417

Indicators of Compromise

Changes to the Ghost site locale setting containing ../, encoded traversal sequences, or non-standard locale identifiers.
Ghost process file reads targeting paths outside the active theme directory, especially config.*.json files.
Admin API calls to /ghost/api/admin/settings/ that modify locale with suspicious payloads.

Detection Strategies

Audit Ghost admin activity logs for settings.edit events that update the locale key.
Inspect the Ghost configuration store and database for any locale value not matching an expected language code.
Enable filesystem auditing on the Ghost installation directory and alert on reads of sensitive JSON files by the Ghost process.

Monitoring Recommendations

Forward Ghost application and web server logs to a central analytics platform for correlation.
Alert on administrator session activity from unusual IP addresses or user agents immediately before locale changes.
Monitor outbound traffic from the Ghost host for exfiltration of leaked credentials to third-party services.

How to Mitigate CVE-2026-104417

Immediate Actions Required

Upgrade Ghost to version 6.64.0 or later on all production and staging instances.
Rotate secrets stored in config.production.json and any JSON-based credential files on the Ghost server.
Review the current locale setting on every Ghost site and reset it to a known-good language code.
Audit the administrator account list and remove unused or stale admin users.

Patch Information

The maintainers fixed the vulnerability in Ghost 6.64.0. The patch constrains translation file resolution to the active theme directory and rejects locale values containing path separators or traversal sequences. Full details are available in the GitHub Security Advisory GHSA-m382-6jw4-fmp6.

Workarounds

Restrict administrator access to the Ghost admin panel using network ACLs or a VPN until the upgrade is applied.
Enforce multi-factor authentication for all Ghost administrator accounts to reduce the risk of credential-based abuse.
Run Ghost under a dedicated low-privilege user with filesystem permissions limited to the Ghost content directory.
Store sensitive configuration outside the Ghost installation tree and inject it through environment variables where feasible.

bash

# Configuration example: upgrade Ghost CLI-managed instance to the patched release
ghost update --v 6.64.0
ghost ls