CVE-2026-105676: Ghost CMS Information Disclosure Flaw

CVE-2026-105676 is an information disclosure vulnerability in Ghost CMS allowing authenticated administrators to read JSON files outside theme directories, potentially exposing server secrets. This article covers technical details, affected versions from 1.20.0 to 6.64.0, impact assessment, and mitigation strategies.

CVE-2026-105676 Overview

Ghost, a Node.js content management system, contains a path traversal vulnerability [CWE-22] in its theme translation file loader. The flaw affects versions 1.20.0 through 6.63.x and allows an authenticated Administrator to read arbitrary JSON files outside of the active theme's directory. Successful exploitation can expose server configuration secrets stored in JSON format on the host. The issue is resolved in Ghost version 6.64.0.

Critical Impact
An authenticated Administrator can read JSON files outside the theme directory, potentially disclosing sensitive server configuration and credentials stored on disk.

Affected Products

Ghost CMS versions 1.20.0 through 6.63.x
Self-hosted Ghost Node.js installations
Deployments where administrators are not fully trusted

Discovery Timeline

2026-10-05 - CVE-2026-105676 published to the National Vulnerability Database
2026-10-06 - Last updated in NVD database
Ghost v6.64.0 - Fix released by the Ghost project (Release Notes)

Technical Details for CVE-2026-105676

Vulnerability Analysis

The vulnerability resides in how Ghost loads translation JSON files for the active theme. The translation loader accepts a locale or path value that is concatenated into a file read operation without sufficient normalization or containment checks. An authenticated Administrator can supply crafted input that traverses out of the theme directory using relative path segments. The loader then returns the parsed contents of the targeted JSON file to the caller.

Because the loader is restricted to JSON files, exploitation does not grant arbitrary file read of binaries or source code. However, many Node.js deployments keep configuration data such as config.production.json on disk, which may contain database credentials, mail provider secrets, and API keys. Reading those files via the translation loader allows credential harvesting from the host.

Root Cause

The underlying defect is improper limitation of a pathname to a restricted directory [CWE-22]. Ghost's theme translation code resolves user-controlled locale identifiers against the theme locale folder without validating that the resolved path remains inside that folder. Path traversal sequences escape the intended root.

Attack Vector

Exploitation requires network access to the Ghost admin interface and valid Administrator credentials. The attacker triggers theme translation loading with a crafted locale value referencing a JSON file elsewhere on the filesystem. See GitHub Security Advisory GHSA-m382-6jw4-fmp6 and Ghost Issue #30635 for coordinating technical context.

text

-import LOCALE_DATA from '@tryghost/i18n/lib/locale-data.json';
+import LOCALE_DATA from '@tryghost/i18n/locale-data.json';
 import React from 'react';
 import TopLevelGroup from '@/settings/components/top-level-group';
 import useSettingGroup from '@/settings/hooks/use-setting-group';

Source: Ghost commit d2f49869. The patch restructures how @tryghost/i18n locale data is sourced, part of the broader fix that consolidates translation handling.

Detection Methods for CVE-2026-105676

Indicators of Compromise

Administrator-authenticated requests to theme or settings endpoints containing ../ sequences or absolute paths in locale parameters.
Unexpected access patterns to Ghost configuration files such as config.production.json on the host filesystem.
Admin API activity originating from unusual IP addresses or at unusual times for accounts with the Administrator role.

Detection Strategies

Review Ghost admin and application logs for 2xx responses tied to translation-loading routes referencing non-standard locale values.
Correlate admin session activity with file access telemetry on the Ghost server to flag reads of files outside the active theme's locales/ directory.
Alert on any Administrator account change immediately followed by theme or settings interactions that reference file paths.

Monitoring Recommendations

Enable verbose request logging for the Ghost admin API and ship logs to a central platform for retention and correlation.
Monitor filesystem access to Ghost's content/ and configuration directories using host-based telemetry.
Track Administrator role assignments and alert on new or recently elevated accounts.

How to Mitigate CVE-2026-105676

Immediate Actions Required

Upgrade Ghost to version 6.64.0 or later as published in the v6.64.0 release.
Rotate secrets stored in Ghost configuration files, including database passwords, mail provider credentials, and third-party API keys.
Audit the list of accounts holding the Administrator role and remove any that are not required.

Patch Information

The fix is included in Ghost 6.64.0. The upstream commit d2f49869 and related changes consolidate translation handling and remove the unsafe file resolution path. Review the GitHub Security Advisory GHSA-m382-6jw4-fmp6 for the authoritative advisory and affected version ranges.

Workarounds

Restrict access to the Ghost admin interface using network controls such as IP allowlists or a VPN until the upgrade is applied.
Enforce strong, unique credentials and multi-factor authentication for all Administrator accounts.
Run the Ghost process under a dedicated unprivileged user with filesystem permissions scoped so configuration files are readable only to that user.

bash

# Upgrade Ghost CLI-managed installation to the patched release
ghost update --version 6.64.0
ghost ls