CVE-2023-32235: Path Traversal
Published May 5, 2023
·Updated
Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.
Affected Software
2 affected componentsFixes available
npm/ghost<5.42.1
5.42.1
Ghost Ghost Node.js<5.42.1
Remediation
Event History
May 5, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
05:15 AM
Description
Advisory Published
06:30 AM
Aug 11, 2025
Exploit Published
12:00 AM
Known Exploited
06:59 PM
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2023-32235.
2
What is the severity of CVE-2023-32235?
The severity of CVE-2023-32235 is high with a CVSS score of 7.5.
3
How can remote attackers exploit CVE-2023-32235?
Remote attackers can exploit CVE-2023-32235 to read arbitrary files within the active theme's folder through directory traversal.
4
Which versions of Ghost are affected by CVE-2023-32235?
Ghost versions up to but excluding 5.42.1 are affected by CVE-2023-32235.
5
How can I fix CVE-2023-32235?
To fix CVE-2023-32235, update Ghost to version 5.42.1.