---
id: CVE-2026-70592
title: Ghost is a Node.js content management system
summary: >-
  Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an
  Administrator-level user could remotely overwrite certain files on the
  filesystem through the database backup filename, leading to integrity and
  availability issu…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L'
cwe:
  - CWE-22
vendor: ghost
product: ghost
affected:
  - 'ghost >= 1.20.1, < 6.54.1'
patched:
  - ghost 6.54.1
published: '2026-08-04'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:51:43.490'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-70592'
references:
  - url: >-
      https://github.com/TryGhost/Ghost/commit/f466c300191a609ed36c8d7c5d1e33ccd440786b
    label: security-advisories@github.com
  - url: 'https://github.com/TryGhost/Ghost/releases/tag/v6.54.1'
    label: security-advisories@github.com
  - url: 'https://github.com/TryGhost/Ghost/security/advisories/GHSA-cj62-hvv2-2q5h'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-cj62-hvv2-2q5h'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.00298
epssPercentile: 0.22656
aliases:
  - GHSA-cj62-hvv2-2q5h
ecosystem: npm
ingestedAt: '2026-08-04T21:42:19.289Z'
---

## Overview

Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path separators in the caller-supplied filename. This issue is fixed in version 6.54.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-70592)

Affected packages:

- `ghost >= 1.20.1, < 6.54.1`

Patched in:

- `ghost 6.54.1`

Source: https://github.com/advisories/GHSA-cj62-hvv2-2q5h