CVE-2026-70592
Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path separators in the caller-supplied filename. This issue is fixed in version 6.54.1.
- CVSS 3.1
- 5.5
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L - EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-25)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cj62-hvv2-2q5h | npm | ghost | >=1.20.1 <6.54.1 | 6.54.1 |