CVE-2026-70592: Ghost: Database Backup Path Traversal
Impact
An Administrator-level user could remotely overwrite certain files on the filesystem leading to integrity and availability issues.
Vulnerable versions
This vulnerability is present in Ghost from 1.20.1 up to v6.54.0.
Patches
v6.54.1 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
Workarounds
If upgrading immediately is not possible, set disableJSBackups to "true" by running:
sh $ ghost config set disableJSBackups true $ ghost restart
References
Ghost thanks Jorian Woltjer of Aikido Security, Mitchell Benjamin of Revamp Studio, and meifukun for disclosing this vulnerability responsibly.
For more information
If you have any questions or comments about this advisory, email Ghost at security@ghost.org.
Other sources
Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path separators in the caller-supplied filename. This issue is fixed in version 6.54.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/ghostto a version that resolves this vulnerability.Fixed in 6.54.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.54.1 - Configuration
If upgrading immediately is not possible, set disableJSBackups to "true" (e.g., run `ghost config set disableJSBackups true`) and then restart Ghost (e.g., `ghost restart`). This workaround applies to Ghost versions from 1.20.1 up to v6.54.0.
Ghost disableJSBackups = true
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70592?
CVE-2026-70592 has a medium severity rating of 5.5.
How do I fix CVE-2026-70592?
To fix CVE-2026-70592, update Ghost to version 6.54.1 or later.
What is the impact of CVE-2026-70592?
CVE-2026-70592 allows an Administrator-level user to remotely overwrite files, causing integrity and availability issues.
Which versions of Ghost are affected by CVE-2026-70592?
CVE-2026-70592 affects Ghost versions from 1.20.1 up to 6.54.0.
What type of vulnerability is CVE-2026-70592?
CVE-2026-70592 is classified as a Path Traversal vulnerability.