{"uuid": "bf352174-7052-44ad-b2e9-4811ef5f5c9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70593", "type": "seen", "source": "https://gist.github.com/alon710/8b519f2c594fb49b15bc37a85db39cf9", "content": "# CVE-2026-70593: CVE-2026-70593: Path Traversal and Arbitrary File Write via Custom Theme Upload in Ghost CMS\n\n> **CVSS Score:** 6.6\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70593\n\n## Summary\nCVE-2026-70593 is a path traversal and arbitrary file write vulnerability affecting Ghost CMS. Versions from 0.10.0 up to 6.54.0 are vulnerable. Authenticated administrators can exploit this flaw by uploading a custom theme in a ZIP archive that contains path traversal characters. The vulnerability is mitigated in version 6.54.1.\n\n## TL;DR\nA path traversal flaw in Ghost CMS theme extraction allows authenticated users with administrative privileges to write arbitrary files to the local file system using crafted ZIP archives.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS Score**: 6.6 (Medium)\n- **EPSS Score**: N/A\n- **Exploit Status**: PoC available, no active in-the-wild exploitation observed\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost CMS (Self-hosted instances)\n- **Ghost**: >= 0.10.0, < 6.54.1 (Fixed in: `6.54.1`)\n\n## Mitigation\n\n- Upgrade Ghost CMS to version 6.54.1 or higher.\n- Enforce least-privilege system permissions for the Ghost server process.\n- Limit user permissions to restrict theme uploads to highly trusted administrators.\n\n**Remediation Steps:**\n1. Access the local hosting environment of your Ghost installation.\n2. Create a full backup of the system configuration, database, and content files.\n3. Run the upgrade command: 'ghost update' to patch the installation to 6.54.1 or higher.\n4. Verify that the active Ghost service processes run under a dedicated, unprivileged system user.\n\n## References\n\n- [GitHub Security Advisory GHSA-cjc9-q5gf-327p](https://github.com/TryGhost/Ghost/security/advisories/GHSA-cjc9-q5gf-327p)\n- [CVE-2026-70593 Record](https://www.cve.org/CVERecord?id=CVE-2026-70593)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70593) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T02:31:21.552509Z"}