CVE-2026-70592 — Ghost: Database Backup Path Traversal
Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database…
Published: 2026-08-04 · CVSS: 5.5 · CVSS 3.1
Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path separators in the caller-supplied filename. This issue is fixed in version 6.54.1.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7