Ghost vulnerabilities
We track 6 vulnerabilities in Ghost products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on June 16, 2024.
Latest Ghost vulnerabilities
- 9.1 Critical severity
ghost: Weak Authentication
Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. NOTE: the vendor's position is that Ghost should be installed with a reverse proxy that allows
- 9.0 Critical severity
Ghost: Improper Neutralization of Input During Web Page Generation
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer repo
- 7.5 High severity
Ghost: Improper Limitation of a Pathname to a Restricted Directory
Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.
- 9.8 Critical severity
node-sqlite3: Improper Control of Dynamically-Managed Code Resources
A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerabilit
- 9.8 Critical severity
Ghost: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by
- 9.8 Critical severity
Ghost: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trus