CVE-2026-105676 · GHSA-m382-6jw4-fmp6
Ghost: Path Traversal via Locale Setting
- Risk score
- 41/100
- CVSS
- 4.9 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 5 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is fixed in version 6.64.0.
- Affected
- ghost (npm) >= 1.20.0, < 6.64.0
- Fix
- Upgrade ghost to 6.64.0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
ghost: Amber, patch this week. Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the…
The flaws
- CVE-2026-105676: Ghost: Path Traversal via Locale Setting (CVSS 4.9 · EPSS 0%)
- CVE-2026-105642: Ghost: Remote Code Execution via Bookmark Card Images (CVSS 8.8 · EPSS 0%)
- CVE-2026-105650: Ghost: Stored XSS via oEmbed Photo Responses (CVSS 8.1 · EPSS 0%)
- CVE-2026-105677: Ghost: Remote Code Execution via Theme Translation Files (CVSS 7.2 · EPSS 1%)
The fix
Upgrade ghost: 6.64.0 · 6.67.0 or later on your release line
Who is exposed: ghost (npm) >= 6.56.0, < 6.67.0
Where it stands
- No known exploitation
Connects to
- Same weakness: Path traversal (CWE-22). 398 other warnings in 30 days
Why it is Yellow
- CVSS 4.9 medium
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| ghost | npm | >= 1.20.0, < 6.64.0 | 6.64.0 |
References
- https://github.com/advisories/GHSA-m382-6jw4-fmp6
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-m382-6jw4-fmp6
- https://nvd.nist.gov/vuln/detail/CVE-2026-105676
- https://github.com/TryGhost/Ghost/issues/30635
- https://github.com/TryGhost/Ghost/pull/30635
- https://github.com/TryGhost/Ghost/commit/d2f498694be549074dd5817fd0e8a1371b65df02
- https://github.com/TryGhost/Ghost/releases/tag/v6.64.0
- https://github.com/advisories/GHSA-m382-6jw4-fmp6
Original description
Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is fixed in version 6.64.0.
Last activity 5 Oct 2026. Patch Forecast updates every hour.