Dashboard / CVE-2026-70593

CVE-2026-70593

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 48/100
Published: 2026-08-04 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network No Interaction Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: High
PR: High
UI: None
S: Changed
C: None
I: High
A: Low

Description

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBase and theme storage name handling. This issue is fixed in version 6.54.1.

Weakness Classification (1)

References & Advisories (3)

Bug Bounty Relevance

48 / 100
✓ Network accessible
✓ No user interaction

CVSS Score

6.6 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:L

EPSS — Exploitation Probability

0.41%
Raw Score 0.004120
Percentile 35.5%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00412
2026-10-28
0.00412

Intelligence Sources

nvd ref →

External Links