CVE-2026-70592: Ghost: Database Backup Path Traversal

August 4, 2026 (updated August 19, 2026)

An Administrator-level user could remotely overwrite certain files on the filesystem leading to integrity and availability issues.

References

github.com/TryGhost/Ghost/commit/f466c300191a609ed36c8d7c5d1e33ccd440786b
github.com/TryGhost/Ghost/releases/tag/v6.54.1
github.com/TryGhost/Ghost/security/advisories/GHSA-cj62-hvv2-2q5h
github.com/advisories/GHSA-cj62-hvv2-2q5h
nvd.nist.gov/vuln/detail/CVE-2026-70592

Code Behaviors & Features

Detect and mitigate CVE-2026-70592 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →