CVE-2026-70593: Ghost: Theme Upload Path Traversal

August 4, 2026

A vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation.

References

github.com/TryGhost/Ghost/commit/fbaa92327e52607036a1e42204c9eadcc751d82c
github.com/TryGhost/Ghost/releases/tag/v6.54.1
github.com/TryGhost/Ghost/security/advisories/GHSA-cjc9-q5gf-327p
github.com/advisories/GHSA-cjc9-q5gf-327p
nvd.nist.gov/vuln/detail/CVE-2026-70593

Code Behaviors & Features

Detect and mitigate CVE-2026-70593 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →