GHSA-jj74-hc2q-xrvm: Path Traversal

Q: Who can exploit this issue?

An attacker must be authenticated as a Ghost Administrator and be able to provide a crafted theme. The issue is not described as exploitable by unauthenticated or lower-privileged users.

Q: Which Ghost installations need to be updated?

Ghost versions from 6.10.3 through 6.64.0 are affected. Update to version 6.64.0, which contains the fix.

Q: What is the impact if exploitation succeeds?

A crafted theme can cause arbitrary code execution on the Ghost server. This can compromise the confidentiality, integrity, and availability of the server.

Q: What should self-hosted operators do?

Update Docker-based deployments using the official Ghost image and documented Docker update process. Ghost-CLI installations should be updated using the Ghost update documentation.

Published Oct 7, 2026

Updated

Impact

A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme.

Vulnerable versions

This vulnerability is present in Ghost from v6.10.3 up to v6.64.0.

Patches

v6.64.0 contains a fix for this issue.

How to update

For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.

If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.

References

Ghost thanks Miguel Segovia Gil of KPMG, Alemmi, and Tomer-PL for disclosing this vulnerability responsibly.

For more information

If you have any questions or comments about this advisory, email us at security@ghost.org.

Affected Software

1 affected componentFixes available

npm/ghost>=6.10.3<6.64.0

6.64.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/ghost to a version that resolves this vulnerability.
Fixed in 6.64.0
Upgrade
Upgrade Ghost to a version that resolves this vulnerability.
Fixed in v6.64.0

Event History

Oct 7, 2026

Advisory Published

via GitHub·08:26 PM

Data Sourced

via GitHub·08:26 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated as a Ghost Administrator and be able to provide a crafted theme. The issue is not described as exploitable by unauthenticated or lower-privileged users.

Which Ghost installations need to be updated?

Ghost versions from 6.10.3 through 6.64.0 are affected. Update to version 6.64.0, which contains the fix.

What is the impact if exploitation succeeds?

A crafted theme can cause arbitrary code execution on the Ghost server. This can compromise the confidentiality, integrity, and availability of the server.

What should self-hosted operators do?

Update Docker-based deployments using the official Ghost image and documented Docker update process. Ghost-CLI installations should be updated using the Ghost update documentation.

GHSA-jj74-hc2q-xrvm: Path Traversal

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which Ghost installations need to be updated?

What is the impact if exploitation succeeds?

What should self-hosted operators do?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which Ghost installations need to be updated?

What is the impact if exploitation succeeds?

What should self-hosted operators do?