CVE-2026-103290 in Ghost
Summary
by MITRE • 10/01/2026
Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended data storage directories on the server.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/01/2026
The Ghost content management platform, specifically versions ranging from 6.14.0 up to but not including version 6.27.0, suffers from a critical path traversal vulnerability within its ImageSize service component. This security flaw stems directly from insufficient input validation regarding user-supplied file paths. The core technical issue lies in the application's failure to properly sanitize or canonicalize directory inputs before processing them for image resizing operations. When an authenticated staff user provides a filename or path parameter, the backend logic does not adequately verify that the resulting resolved path remains within the designated data storage directories intended by the system architecture. This lack of strict boundary enforcement allows attackers to manipulate input strings using standard traversal sequences such as dot-dot-slash characters to escape the sandboxed directory structure and reference arbitrary files located elsewhere on the server's filesystem.
From a technical perspective, this vulnerability represents a classic instance of insecure direct object references combined with path manipulation techniques. The ImageSize service is designed to process images for display or optimization purposes, which inherently requires reading file contents from disk. However, because the validation logic fails to normalize paths and check them against an allowlist of permitted directories, it becomes possible to read sensitive system files that are not meant to be accessible through this API endpoint. This flaw effectively bypasses the intended isolation between user-uploaded content and other server-side resources, creating a direct pathway for unauthorized data exfiltration by any authenticated staff member who possesses valid credentials for the Ghost administration interface.
The operational impact of this vulnerability is significant due to its potential for information disclosure. An attacker leveraging this path traversal flaw can access configuration files containing database connection strings, API keys, and secret tokens stored on the server. Furthermore, they may be able to read source code from other applications running on the same host if directory permissions allow it. This exposure compromises the confidentiality of sensitive data and could serve as a stepping stone for further attacks, such as remote code execution or privilege escalation, depending on what files are accessible and how their contents can be utilized within the broader application ecosystem. The risk is heightened by the fact that authentication is required, meaning only users with existing staff accounts can exploit this issue, which limits the attack surface but increases the severity for compromised administrative credentials.
In terms of industry standard classifications, this vulnerability aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-20: Improper Input Validation. It also maps to specific tactics within the MITRE ATT&CK framework, particularly T1530: Data from Local System which covers accessing files on local storage for reconnaissance or data staging purposes. The exploitation method falls under techniques related to file discovery and unauthorized access to restricted directories, highlighting the importance of strict input sanitization in services that handle filesystem operations.
To mitigate this vulnerability, organizations running affected versions must upgrade Ghost immediately to version 6.27.0 or later where these path validation checks have been corrected. Until an upgrade is feasible, administrators should ensure that staff accounts are strictly limited to those who absolutely require access and monitor logs for unusual file read patterns originating from the ImageSize endpoint. Additionally, implementing a web application firewall with rules capable of detecting directory traversal sequences in API parameters can provide a layer of defense against exploitation attempts. It is also advisable to review server-level permissions to ensure that even if path traversal occurs, the operating system restricts access to critical configuration files and sensitive data directories through proper file ownership and permission settings.