CVE-2026-103290: Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize
Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended data storage directories on the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghostto a version that resolves this vulnerability.Fixed in 6.27.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Ghost staff user can exploit it. The issue is remotely reachable, but it requires staff-level privileges and does not require user interaction.
Which deployments are affected?
Ghost versions 6.14.0 through versions before 6.27.0 are affected. Ghost 6.27.0 is not included in the affected range.
What is the impact of successful exploitation?
A staff user may use crafted file paths to access local files outside the server's intended data storage directories. The stated impact includes limited confidentiality and availability effects, with no integrity impact indicated.