CVE-2026-105683

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-105683
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105683.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-105683
Aliases
Published
2026-10-05T19:31:28Z
Modified
2026-10-07T02:47:26Z
Severity
  • 3.8 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L CVSS Calculator
Summary
Ghost: Path Traversal Vulnerability in Ghost ImageSize Service
Details

Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-35"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105683.json"
}
References

Affected packages

Git / github.com/tryghost/ghost

Affected ranges

Type
GIT
Repo
https://github.com/tryghost/ghost
Events
Introduced
e5a5cde533dfb2c2d8f9b60223b046075b5e4b13
Fixed
770d438fd9d352bbfccbe81dd890580a1d3fd6f0
Fixed
2daa6eba775c961ca41f2732b622d9deb86a39ee
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "6.14.0"
        },
        {
            "fixed": "6.27.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v6.*
v6.14.0
v6.15.0
v6.16.0
v6.16.1
v6.17.0
v6.17.1
v6.18.0
v6.18.2
v6.19.0
v6.19.1
v6.19.2
v6.19.3
v6.19.4
v6.20.0
v6.20.1
v6.21.0
v6.21.1
v6.21.2
v6.22.0
v6.22.1
v6.23.0
v6.24.0
v6.25.0
v6.25.1
v6.26.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105683.json"