CVE-2026-70592

Severity CVSS v4.0:

Pending analysis

Type:

CWE-22 Path Traversal

Publication date:

04/08/2026

Last modified:

05/08/2026

Description

Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path separators in the caller-supplied filename. This issue is fixed in version 6.54.1.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L CVSS v3.1 Severity and Metrics:

Base Score: 5.50 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): High
User Interaction (UI): None
Scope (S): Changed
Confidentiality (C): None
Integrity (I): Low
Availability (A): Low

Base Score 3.x

5.50

Severity 3.x

MEDIUM

CVE-2026-70592

Description

Impact

References to Advisories, Solutions, and Tools