Ghost CMS CVE-2026-105676

Exploitation requires an authenticated session with the Administrator role - the highest-privilege Ghost user - so this is not remotely exploitable by anonymous users. The specific prerequisite is access to the theme translation-file loading mechanism: the attacker must be able to cause Ghost to load a theme translation (locale JSON) file whose resolved path traverses outside the active theme's directory. Affected deployments are Ghost versions from 1.20.0 up to (but not including) 6.64.0; instances on 6.64.0 or later are not vulnerable. The limiting factors are the mandatory Administrator authentication level and the fact that impact is confined to reading JSON files (confidentiality only) - value to an attacker depends on sensitive JSON (e.g. config secrets) being present and readable on the server filesystem.

This is a genuinely low-to-moderate priority issue despite the CWE-22 path traversal classification. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N = 4.9 Medium) is internally consistent with the description: exploitation requires an authenticated Administrator (PR:H), which is the highest-trust role in Ghost, sharply limiting the attacker population to users who already control the site. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no public exploit identified at time of analysis. The confidentiality-only impact (C:H, I:N, A:N) reflects that the flaw permits reading arbitrary JSON files outside the theme directory (potentially server config secrets) but grants no write or availability impact. The signals do not conflict, but note that PR:H means the practical risk is post-compromise privilege escalation / secret disclosure rather than external breach - a malicious or compromised admin account is the real threat model. One caveat: the source-code evidence (commit d2f4986) shown in the input consists almost entirely of i18n/locale-data import-path, Vite config, and flexsearch RTL changes and does NOT visibly contain the theme-translation path-traversal remediation, so the fix cannot be independently verified from the provided diff.

A user with (or who has hijacked) an Administrator account in a Ghost instance abuses the theme translation file loader by referencing a translation/locale path that traverses outside the active theme's directory, causing Ghost to read and return an arbitrary JSON file on the server - such as a configuration file containing database credentials or API secrets. No public exploit code was identified, and because Administrator privileges (PR:H) are required, this is realistically a privilege-to-secret escalation step rather than an unauthenticated remote breach.