CVE-2026-70592
published 2026-08-04CVE-2026-70592: Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem…
PriorityP429medium5.5CVSS 3.1
AVNACLPRHUINSCCNILAL
EPSS
0.44%
35.7th percentile
Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path separators in the caller-supplied filename. This issue is fixed in version 6.54.1.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ghost | ghost | >= 1.20.1 < 6.54.1 | 6.54.1 |
| tryghost | ghost | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
TryGhost up to 6.54.0 Database Export Endpoint path traversal
vuldb·2026-08-05·CVSS 5.5
CVE-2026-70592 [MEDIUM] TryGhost up to 6.54.0 Database Export Endpoint path traversal
A vulnerability labeled as problematic has been found in TryGhost Ghost up to 6.54.0. Affected by this vulnerability is an unknown functionality of the component Database Export Endpoint. Executing a manipulation can lead to path traversal.
This vulnerability is registered as CVE-2026-70592. It is possible to launch the attack remotely. No exploit is available.
The affected component should be upgraded.
GHSA
Ghost: Database Backup Path Traversal
ghsa·2026-08-04
CVE-2026-70592 [MEDIUM] CWE-22 Ghost: Database Backup Path Traversal
Ghost: Database Backup Path Traversal
### Impact
An Administrator-level user could remotely overwrite certain files on the filesystem leading to integrity and availability issues.
### Vulnerable versions
This vulnerability is present in Ghost from 1.20.1 up to v6.54.0.
### Patches
v6.54.1 contains a fix for this issue.
### How to update
For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost).
If your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update).
### Workarounds
If upgrading immediately is not possible, set *disableJSBackups* to "true" by
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-04
Published