CVE-2026-70592: Ghost CMS Path Traversal Vulnerability

CVE-2026-70592 Overview

Ghost, a Node.js content management system, contains a path traversal vulnerability [CWE-22] in its database export endpoint. From version 1.20.1 through 6.54.1, an authenticated Administrator-level user can supply a filename containing path separators to overwrite arbitrary files on the host filesystem. The database export endpoint fails to reject path separators in the caller-supplied filename. The issue affects integrity and availability of files reachable by the Ghost process. The maintainers fixed this issue in version 6.54.1.

Critical Impact
An authenticated administrator can overwrite files outside the intended backup directory, enabling tampering with application files, configuration, or content served by the host.

Affected Products

Ghost (Node.js CMS) versions 1.20.1 through 6.54.0
Ghost self-hosted deployments exposing the admin API
Ghost instances where the export endpoint is reachable by administrators

Discovery Timeline

2026-08-04 - CVE-2026-70592 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70592

Vulnerability Analysis

Ghost exposes a database export endpoint that accepts a caller-supplied filename for the resulting backup archive. The endpoint concatenates this value into a filesystem path without validating that the input stays within the intended output directory. An administrator can submit a filename containing directory separators such as ../ to traverse outside the backup directory and write the export file to an attacker-chosen location.

The attacker requires Administrator privileges, which limits the exploit population but does not eliminate the risk. Compromised administrator credentials, session hijacking, or insider misuse convert this into a file-overwrite primitive. The write is performed by the Ghost process, so target files must be writable by the Ghost service account.

Successful exploitation lets an attacker overwrite configuration files, static content, theme assets, or logs. This can degrade availability by clobbering critical files, or affect integrity by replacing files served to visitors. The vulnerability does not directly disclose data, but downstream code-execution scenarios are possible depending on which files the Ghost user can write.

Root Cause

The root cause is missing path sanitization in the export filename handler. The patch in commit f466c30 introduces the Node.js path module into ghost/core/core/server/api/endpoints/db.js and ghost/core/core/server/data/exporter/export-filename.js, enabling proper normalization and validation of the filename before it is used to construct the output path.

Attack Vector

An authenticated administrator sends a request to the database export endpoint with a filename parameter containing path traversal sequences such as ../../etc/target-file. The server writes the export payload to the resolved path, overwriting any existing file at that location that the Ghost process can write.

javascript

// Patch excerpt: ghost/core/core/server/api/endpoints/db.js
 const moment = require('moment-timezone');
+const path = require('path');
 const dbBackup = require('../../data/db/backup');
 const exporter = require('../../data/exporter');
 const importer = require('../../data/importer');

// Patch excerpt: ghost/core/core/server/data/exporter/export-filename.js
 const errors = require('@tryghost/errors');
 const security = require('@tryghost/security');
 const models = require('../../models');
+const path = require('path');

Source: GitHub Commit f466c30

Detection Methods for CVE-2026-70592

Indicators of Compromise

Requests to the Ghost database export endpoint containing ../, ..\, or absolute path characters in the filename parameter.
Unexpected files matching Ghost export archive signatures written outside the configured content or data directory.
Modified timestamps on Ghost configuration files, theme assets, or static content that do not correlate with admin content changes.
Administrator API sessions that trigger export operations at unusual times or from unusual source addresses.

Detection Strategies

Inspect Ghost application and reverse-proxy access logs for POST or GET requests to the /db/ export route with suspicious filename values.
Deploy file integrity monitoring on the Ghost installation directory, configuration files, and any web root paths the Ghost user can write.
Alert on any process spawned by the Ghost service account writing to paths outside the standard content/data backup directory.
Correlate administrator login events with subsequent export API calls to identify anomalous behavior.

Monitoring Recommendations

Enable verbose audit logging for administrator API actions, including export requests and their parameters.
Forward Ghost application logs and host filesystem events to a central analytics platform for correlation and retention.
Monitor the count and destination of database export operations per administrator account and threshold on deviations.

How to Mitigate CVE-2026-70592

Immediate Actions Required

Upgrade Ghost to version 6.54.1 or later on all self-hosted instances.
Audit the administrator user list and remove or downgrade accounts that do not require Administrator privileges.
Rotate credentials and active sessions for administrator accounts if compromise is suspected.
Review filesystem timestamps under the Ghost installation directory for signs of unauthorized writes.

Patch Information

The fix is available in Ghost v6.54.1. See the GitHub Security Advisory GHSA-cj62-hvv2-2q5h and the GitHub Release v6.54.1 for release notes. The corrective code is in commit f466c30.

Workarounds

Restrict network access to the Ghost admin interface using IP allowlisting or a VPN until the patch is applied.
Run the Ghost process under a dedicated, unprivileged service account with write access only to the required content directories.
Enforce multi-factor authentication for all Administrator accounts to reduce the risk of credential misuse.
Apply mandatory access controls such as AppArmor or SELinux profiles to constrain the paths the Ghost process can write.

bash

# Upgrade Ghost self-hosted instance to the patched release
ghost update --version 6.54.1

# Verify the running version after upgrade
ghost version