Ghost CMS EUVD-2026-91428

Requires an authenticated Ghost administrator account (CVSS PR:H) - the attacker must be able to modify the locale/language setting that drives theme translation file loading. Exploitation works against affected versions (1.20.0 up to but not including 6.64.0) by injecting path-traversal sequences into the locale value so the translation loader resolves a JSON file outside the active theme directory. Limiting factors: impact is confined to reading JSON-format files (not arbitrary file types or write/RCE), it needs the high-privilege admin role rather than anonymous access, and it is remediated in Ghost 6.64.0; the practical payoff depends on sensitive JSON (e.g., config/secrets) being present and readable on the server filesystem.

This is a moderate-risk, administrator-gated information-disclosure flaw rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N) scores 6.9 (medium) and is internally consistent with the description: network-reachable but requiring high privileges (PR:H = authenticated administrator), low complexity, no user interaction, and pure confidentiality impact with no integrity or availability effect. No EPSS score, KEV listing, or SSVC decision data was provided in the input, and no public exploit is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The real-world priority is tempered sharply by the PR:H requirement: an attacker must already hold admin credentials on the Ghost instance, which greatly narrows the threat population to insiders, compromised admin accounts, or multi-tenant/shared-admin setups. The notable escalation value is that an already-privileged admin can read JSON files outside the theme directory (e.g., configuration containing secrets), potentially yielding database credentials, mail/API keys, or session secrets that enable lateral movement or full environment compromise. Net: patch promptly in environments where admin access is broadly or semi-trustedly delegated, but this is not a mass-exploitation, internet-wide drive-by risk.

An authenticated Ghost administrator (or an attacker who has phished/compromised an admin session) sets the site or theme locale to a crafted value that uses path-traversal sequences, causing Ghost's theme translation loader to read a JSON file outside the active theme directory. The attacker retrieves a configuration or secrets file on the server, harvesting credentials or API keys for further compromise. No public exploit is identified at time of analysis, and because the vector is network-based with low complexity and no user interaction, exploitation is straightforward once admin access is held.