Ghost CMS CVE-2026-70592

Exploitation strictly requires a valid Ghost Administrator-level account (PR:H per CVSS); lower-privileged Ghost roles such as Staff, Author, or Contributor cannot access the database export endpoint. The JS backup feature must be in its default enabled state; deployments where an operator has previously set disableJSBackups=true are not exploitable via this vector. The attack is executed remotely over the network (AV:N) with no user interaction required beyond the admin performing the export action. The filesystem impact is bounded by the OS-level permissions of the Ghost process user - typically a dedicated low-privilege service account - which limits which files can actually be overwritten. Ghost instances hosted by Ghost(Pro) are managed by the vendor and are not self-hosted, so the exploitability of that environment is not confirmed from available data.

The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L scoring 5.5 accurately reflects the threat profile. The PR:H rating is the dominant risk-limiting factor: exploitation is gated behind a full Ghost Administrator account, which is a high-trust boundary in most deployments. An attacker cannot exploit this vulnerability from an unauthenticated position or as a lower-privileged Ghost role (Staff, Contributor). The Scope:Changed designation is appropriate because a successful exploit writes files outside Ghost's application directory, potentially affecting OS-level files if the Ghost process has sufficient permissions. No EPSS score was provided in the input data; given the PR:H prerequisite and absence from CISA KEV, opportunistic mass exploitation is implausible. The realistic threat is insider misuse, a compromised admin account used for post-exploitation persistence, or a scenario where an attacker achieves admin access through a separate vulnerability and then chains this flaw to overwrite critical files for persistence. The vendor-provided workaround (disableJSBackups=true) completely eliminates the vulnerable code path with minimal operational trade-off for organizations that do not depend on JS export backups.

An attacker who has obtained Ghost Administrator credentials - through credential stuffing, phishing, or a prior compromise - authenticates to the Ghost admin API and invokes the database export endpoint with a crafted filename such as '../../var/spool/cron/ghost' or another path writable by the Ghost process user. Ghost constructs the export path without sanitization and writes the JSON database export to the traversed filesystem location, overwriting the target file. Depending on which file is overwritten and the process permissions, the attacker can corrupt application state, disrupt service availability, or plant a persistence mechanism.