Ghost CVE-2026-105683

Requires an authenticated Ghost staff-level user account (created by an administrator) on an affected instance running version 6.14.0 up to but not including 6.27.0. Exploitation depends on the instance using the local file storage adapter (LocalStorageBase, the default), where unsanitized path/targetDir/fileName inputs were resolved without enforcing the storage root. Limiting factors: valid staff credentials are mandatory (no unauthenticated access), there is no user-interaction vector against other users, and deployments using a non-local/cloud storage adapter are not affected by this code path; impact is limited to reading files, not modification.

This is a low-severity, authentication-gated information disclosure issue (CWE-35 path traversal) in Ghost's LocalStorageBase storage adapter, confirmed and patched by the vendor in 6.27.0. The provided CVSS of 3.8 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L) correctly reflects a network-reachable but privilege-dependent flaw with limited impact. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - signals are consistent in pointing to low real-world urgency rather than a priority emergency. Two signals merit scrutiny: (1) the description attributes the flaw to 'staff users,' which are authenticated but typically NOT the highest-privilege role, so the vendor's PR:H may overstate the barrier - PR:L is arguably more accurate (see assessed vector); (2) the provided vector lists A:L (availability impact) and I:N, yet the described behavior is reading files outside the storage root, which maps most naturally to a confidentiality-only impact (C present, I/A none) - verify the availability claim with the vendor. Net: a genuine but low-priority, patch-on-normal-cycle issue, not a high-CVSS-but-low-risk mislabel and not an urgent threat.

An attacker holding valid Ghost staff credentials submits a storage-adapter request (e.g., an image/file path) containing directory-traversal sequences, causing the local storage adapter to resolve a path outside the intended data directory and disclose server-side files. No public exploit code is identified at time of analysis, and the attack requires the Ghost instance to use the default local file storage adapter.