high7.5Public exploit code
CVE-2023-32235
Path Traversal in Ghost
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Ghost CMS 5.42.1 - Path Traversal2025-08-11 · webapps · multiple
Impact
Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | ghost | < 5.42.1 | 5.42.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ghost | Ghost | before 5.42.1 |