GHSA-cj62-hvv2-2q5h: Path Traversal
Impact
An Administrator-level user could remotely overwrite certain files on the filesystem leading to integrity and availability issues.
Vulnerable versions
This vulnerability is present in Ghost from 1.20.1 up to v6.54.0.
Patches
v6.54.1 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
Workarounds
If upgrading immediately is not possible, set disableJSBackups to "true" by running:
sh $ ghost config set disableJSBackups true $ ghost restart
References
Ghost thanks Jorian Woltjer of Aikido Security, Mitchell Benjamin of Revamp Studio, and meifukun for disclosing this vulnerability responsibly.
For more information
If you have any questions or comments about this advisory, email Ghost at security@ghost.org.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/ghostto a version that resolves this vulnerability.Fixed in 6.54.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.54.1 - Configuration
If upgrading immediately is not possible, set disableJSBackups to true (e.g., run `ghost config set disableJSBackups true`) and then run `ghost restart`.
Ghost disableJSBackups = true
Event History
Frequently Asked Questions
What is the severity of GHSA-cj62-hvv2-2q5h?
The severity of GHSA-cj62-hvv2-2q5h is medium with a score of 5.5.
How do I fix GHSA-cj62-hvv2-2q5h?
To fix GHSA-cj62-hvv2-2q5h, update to Ghost version 6.54.1 or later.
Which versions of Ghost are affected by GHSA-cj62-hvv2-2q5h?
GHSA-cj62-hvv2-2q5h affects Ghost versions from 1.20.1 up to 6.54.0.
What kind of issue does GHSA-cj62-hvv2-2q5h introduce?
GHSA-cj62-hvv2-2q5h can lead to integrity and availability issues by allowing an administrator-level user to overwrite files.
Is the risk level of GHSA-cj62-hvv2-2q5h critical?
No, the risk level of GHSA-cj62-hvv2-2q5h is medium, not critical.