Ghost CMS EUVD-2026-90683

Exploitation requires an authenticated Ghost staff account (CVSS PR:H) and a running Ghost instance in the affected range (6.14.0 through versions prior to 6.27.0). The specific attack surface is the ImageSize service, which performs insufficient validation of user-supplied file paths, allowing directory-traversal sequences to escape the intended data/storage directories and read arbitrary local files. No user interaction is needed (UI:N) and the service is network-reachable (AV:N). The primary limiting factor is the privilege requirement: an attacker must first hold valid staff credentials, so this is not exploitable by anonymous remote users against default configurations. Impact is bounded to local file reads on the server; versions 6.27.0 and later contain the fix.

All signals point to a moderate, authentication-gated risk rather than an urgent priority. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:L) scores 5.1 and requires high privileges (PR:H), meaning the attacker must already be an authenticated staff user - consistent with the description's 'authenticated staff users' phrasing. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of active or imminent widespread exploitation. The technical impact is limited to confidentiality (reading local files outside the intended storage directory, VC:L) with no integrity impact and only incidental availability impact (VA:L); the arbitrary-file-read primitive could expose configuration files, secrets, or credentials, which raises the practical stakes above the modest base score. One point worth verifying: the vendor assigns PR:H, but 'staff users' in Ghost can include lower-privilege roles (Author/Editor/Contributor), so the true privilege floor may be closer to PR:L - if so, real-world exploitability is slightly higher than the score implies. No conflicting network/local signals exist; AV:N is appropriate for an HTTP-reachable service endpoint.

An attacker who has obtained a Ghost staff account (via phishing, credential reuse, or an insider) submits a crafted file path containing traversal sequences to the ImageSize service, which fails to validate the path and reads a file outside the designated data/storage directories. The attacker uses this to exfiltrate sensitive server-side files such as configuration files containing database credentials or secret keys. No public exploit code is identified at time of analysis, and exploitation requires valid authenticated access (PR:H).