low3.8
CVE-2026-103290
Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service.
Impact
Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended data storage directories on the server.
Affected products
| Product | Affected versions |
|---|---|
| Ghost Versions 6.14.0 Through | before 6.27.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.