CVE-2026-70593: Ghost: Theme Upload Path Traversal

August 4, 2026

A vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation.

References

github.com/TryGhost/Ghost/commit/fbaa92327e52607036a1e42204c9eadcc751d82c
github.com/TryGhost/Ghost/releases/tag/v6.54.1
github.com/TryGhost/Ghost/security/advisories/GHSA-cjc9-q5gf-327p
github.com/advisories/GHSA-cjc9-q5gf-327p
nvd.nist.gov/vuln/detail/CVE-2026-70593

Code Behaviors & Features

Detect and mitigate CVE-2026-70593 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →