CVE-2026-70593: Ghost CMS Path Traversal Vulnerability

CVE-2026-70593 Overview

CVE-2026-70593 is a path traversal vulnerability in Ghost, a Node.js content management system. The flaw affects versions from 0.10.0 up to but not including 6.54.1. A staff user with theme upload permissions can craft a custom theme whose storage name traverses outside the intended uploads directory. This allows the attacker to write files to arbitrary locations on the server and alter the behavior of the Ghost installation. The vulnerability resides in the LocalStorageBase adapter and the theme storage name handling logic, and is tracked as CWE-22 (Path Traversal). Ghost fixed the issue in version 6.54.1.

Critical Impact
An authenticated staff user can write files outside the theme uploads directory, potentially replacing application files and modifying Ghost's runtime behavior.

Affected Products

Ghost CMS versions 0.10.0 through 6.54.0
Self-hosted Ghost installations using the local storage adapter
Ghost deployments where staff users are permitted to upload custom themes

Discovery Timeline

2026-08-04 - CVE-2026-70593 published to the National Vulnerability Database
2026-08-04 - Ghost released version 6.54.1 and published advisory GHSA-cjc9-q5gf-327p
2026-08-05 - CVE record last modified in NVD

Technical Details for CVE-2026-70593

Vulnerability Analysis

Ghost accepts custom themes as file uploads from authenticated staff users. The theme storage subsystem derives an on-disk name for the uploaded artifact and passes it to the LocalStorageBase adapter for persistence. Before the patch, neither layer validated that the resolved output path remained inside the intended targetDir. An attacker who crafts a theme with a name containing path traversal sequences such as ../ or an entry composed solely of dots and slashes can cause the resolved destination to escape the uploads directory.

Because the file write occurs with the privileges of the Ghost process, the attacker can overwrite theme files, configuration assets, or other files reachable by that user. Overwriting a file that Ghost or its themes load at runtime provides a path to modify installation behavior. Exploitation requires high privileges (a staff account with theme upload rights), which limits the practical attack surface but does not eliminate insider or compromised-account risk.

Root Cause

The root cause is missing containment validation on file destinations. The theme storage layer trusted upload-derived names, and LocalStorageBase did not verify that path.resolve(targetFilename) remained under path.resolve(targetDir) before writing. This is a canonical CWE-22 failure to canonicalize and constrain a filesystem path derived from user input.

Attack Vector

Exploitation is network-reachable and requires an authenticated staff account. The attacker uploads a custom theme whose internal name or archive entry contains traversal sequences. The theme storage service builds a target path that resolves outside the uploads directory, and LocalStorageBase writes the payload to that location. Repeating the process with different names lets the attacker place files in multiple locations.

typescript

// Patch: ghost/core/core/server/adapters/storage/LocalStorageBase.ts
const filename = await this.getUniqueFileName(file, targetDir);

targetFilename = filename;

// Verify that we are saving directly under `targetDir` and not outside of it.
const expectedPrefix = path.join(path.resolve(targetDir), '/');
if (!path.resolve(targetFilename).startsWith(expectedPrefix)) {
    throw new errors.BadRequestError({message: 'Cannot save to the given filename'});
}

await fs.mkdirs(targetDir);

Source: GitHub commit fbaa923

javascript

// Patch: ghost/core/core/server/services/themes/storage.js
destroyActive: 'Deleting the active theme is not allowed.'
};

const INVALID_THEME_REGEX = /^[./]*$/;

let themeStorage;

Source: GitHub commit fbaa923 — the added regex rejects theme names composed only of dots and slashes.

Detection Methods for CVE-2026-70593

Indicators of Compromise

Files created or modified outside the Ghost content/themes/ directory by the Ghost process user near the time of a theme upload.
Theme upload API requests to /ghost/api/admin/themes/upload/ containing archive entries or filenames with .., backslashes, or names matching ^[./]*$.
Ghost application logs showing successful theme uploads immediately followed by errors loading themes or configuration files.
New or altered .hbs, .js, or configuration files whose modification timestamps do not match a deployment event.

Detection Strategies

Compare the filesystem tree of the Ghost installation against a known-good baseline and flag any files outside content/themes/ that appear after theme upload activity.
Parse Ghost admin API access logs and alert on POST requests to the theme upload endpoint from staff accounts that rarely upload themes.
Add file integrity monitoring on the Ghost application directory, core modules, and any file loaded at runtime by themes.

Monitoring Recommendations

Forward Ghost admin API logs, filesystem audit events, and process file-write telemetry to a centralized analytics platform for correlation across upload and write events.
Alert on any write by the Ghost process user to paths outside the expected content/ subtree.
Track theme upload frequency per staff account and flag deviations from historical norms.

How to Mitigate CVE-2026-70593

Immediate Actions Required

Upgrade Ghost to version 6.54.1 or later on all self-hosted installations.
Audit staff accounts and remove theme upload permissions from users who do not require them.
Review the Ghost content/ directory and application files for unexpected modifications since the earliest possible exploitation window.
Rotate credentials for any staff account suspected of compromise and review recent admin API activity.

Patch Information

The fix is delivered in Ghost 6.54.1. Release notes are available at Ghost v6.54.1 and the advisory at GHSA-cjc9-q5gf-327p. The patch adds a resolved-path prefix check in LocalStorageBase and rejects theme names that consist only of dots and slashes via INVALID_THEME_REGEX in the theme storage service. See the upstream commit for the full change set.

Workarounds

Restrict the Ghost Administrator and theme-management roles to a minimal set of trusted users until the upgrade can be applied.
Run the Ghost process under a dedicated low-privilege user account whose filesystem write access is limited to the required content/ directories.
Place the Ghost admin interface behind network controls such as an allowlisted VPN or reverse proxy to limit exposure of the theme upload endpoint.

bash

# Upgrade a self-hosted Ghost installation using the ghost-cli
cd /var/www/ghost
ghost update 6.54.1
ghost ls

# Verify the running version after the update
curl -s http://localhost:2368/ghost/api/admin/site/ | grep -i version