CVE-2026-70592

{
  "id": "CVE-2026-70592",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-04T22:17:17.140",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path separators in the caller-supplied filename. This issue is fixed in version 6.54.1."
    },
    {
      "lang": "es",
      "value": "Ghost es un sistema de gestión de contenido Node.js. Desde 1.20.1 hasta 6.54.1, un usuario con nivel de Administrador podía sobrescribir remotamente ciertos archivos en el sistema de archivos a través del nombre de archivo de la copia de seguridad de la base de datos, lo que provocaba problemas de integridad y disponibilidad. El endpoint de exportación de la base de datos no pudo rechazar los separadores de ruta en el nombre de archivo proporcionado por el llamador. Este problema está solucionado en la versión 6.54.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "TryGhost",
          "product": "Ghost",
          "versions": [
            {
              "version": ">= 1.20.1, < 6.54.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-05T14:01:21.561748Z",
          "id": "CVE-2026-70592",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/TryGhost/Ghost/commit/f466c300191a609ed36c8d7c5d1e33ccd440786b",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/TryGhost/Ghost/releases/tag/v6.54.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-cj62-hvv2-2q5h",
      "source": "[email protected]"
    }
  ]
}