CVE-2026-70592: 
JavaScript vulnerability analysis and mitigation

CVE-2026-70592 is a path traversal vulnerability in Ghost, a Node.js content management system, that allows an Administrator-level user to remotely overwrite arbitrary files on the server filesystem via a crafted database backup filename. The vulnerability affects Ghost versions from 1.20.1 through 6.54.0 (inclusive) and was fixed in version 6.54.1. It was published to the GitHub Advisory Database on August 4, 2026, with responsible disclosure credited to Jorian Woltjer of Aikido Security, Mitchell Benjamin of Revamp Studio, and meifukun. The CVSS v3.1 base score is 5.5 (Medium) (Github Advisory, Ghost Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal): the database export API endpoint accepted a caller-supplied filename parameter and passed it directly to file system operations without stripping or rejecting path separator characters (Github Advisory). An authenticated Administrator could supply a filename such as ../../config to cause the exported JSON file to be written outside the intended backup directory, overwriting arbitrary files accessible to the Ghost process. The fix, applied in commit f466c30, adds a check using path.basename() in both db.js and export-filename.js to ensure the filename contains no path separators before proceeding; a ValidationError is thrown if path separators are detected (Ghost Commit).

Successful exploitation allows an authenticated Administrator to overwrite files on the server filesystem that the Ghost process has write access to, leading to integrity and availability impacts. An attacker could corrupt configuration files, application code, or other critical files, potentially causing service disruption or enabling further compromise of the host system. There is no confidentiality impact (no data is read or exfiltrated), and exploitation is limited to the scope of the Ghost process's filesystem permissions (Github Advisory, Ghost Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the advisory date. The NVD SSVC assessment indicates exploitation is "none" and the attack is not automatable, as it requires high privileges (Administrator-level authentication) (Ghost Advisory). The EPSS score is approximately 0.298% (22nd percentile), reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Authenticate as Administrator: Log in to the Ghost admin panel (/ghost/) with an Administrator-level account.
2. Identify the database export endpoint: Locate the API endpoint used for database backup/export, typically accessible via the Ghost Admin API (e.g., POST /ghost/api/admin/db/ or equivalent export action).
3. Craft a malicious filename: Prepare a request with a filename parameter containing path traversal sequences, such as ../../path/to/target, to redirect the output file outside the intended backup directory.
4. Send the crafted request: Submit the export request with the malicious filename via the Ghost Admin API, using a valid Administrator session token in the request headers.
5. File overwrite achieved: The Ghost server writes the exported JSON database content to the attacker-specified path, overwriting the target file. The attacker can target configuration files, scripts, or other writable files to cause service disruption or facilitate further compromise (Ghost Advisory, Ghost Commit).

• Logs: Ghost application logs showing database export requests with filenames containing .., /, or \ characters; HTTP requests to the database export API endpoint with unusual filename parameter values.
• File System: Unexpected .json files appearing outside the Ghost backup directory (e.g., in parent directories or system directories); modification timestamps on configuration or application files coinciding with export API calls.
• Network: Authenticated POST requests to the Ghost Admin API database export endpoint from unexpected IP addresses or at unusual times.

Upgrade Ghost to version 6.54.1 or later, which contains the fix for this vulnerability (Ghost Release). For Docker-based deployments, update to the latest official Ghost Docker image. If an immediate upgrade is not possible, the following workaround disables JavaScript-based backups to prevent exploitation:

$ ghost config set disableJSBackups true
$ ghost restart

This workaround is documented in the official advisory (Github Advisory).

The vulnerability was responsibly disclosed by Jorian Woltjer of Aikido Security, Mitchell Benjamin of Revamp Studio, and meifukun, and Ghost acknowledged their contributions in the official advisory (Ghost Advisory). Community coverage has been limited to standard CVE tracking and aggregator sites, with no notable broader media coverage or significant social media discussion identified.