CVE-2026-70592: Path Traversal Vulnerability in Ghost CMS Database Exporter

CVE-2026-70592 defines a path traversal vulnerability within the database backup and export utility of Ghost CMS, an open-source Node.js-based content management system. This security flaw affects Ghost CMS deployments from version 1.20.1 up to but excluding version 6.54.1. The issue allows an authenticated user with administrative privileges to write or overwrite files outside of the application's designated backup folder.

The vulnerability is located in the administration interface, which is responsible for managing application states and database backups. The application accepts user-supplied parameters to define output archives during backup procedures. This exposed interface allows input to be processed directly by file write operations without structural validation.

Because administrative interfaces are typically exposed to authorized managers over HTTP, exploitation poses a threat to the integrity and availability of the underlying server. An attacker can write to arbitrary locations, leading to application configuration corruption or potential code execution depending on system-level configuration parameters. This vulnerability is cataloged as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

The root cause of CVE-2026-70592 lies in the database export controller processing user-supplied path components without validating or removing directory separator characters. Specifically, the module located at ghost/core/core/server/data/exporter/export-filename.js processes requests by reading a custom filename option directly from client input.

When administrators request a database export, they can specify a custom filename. In vulnerable versions, this parameter is concatenated directly with the .json extension without checking for the presence of path navigation characters. Consequently, path traversal inputs such as ../ are interpreted literally by the underlying operating system filesystem APIs.

When the Node.js standard libraries or stream writers write the database export dump to the disk, they resolve these relative paths relative to the application's root directory. This allows the written file to escape the restricted destination directory. Because the application does not validate that the computed target path resides within the backup folder, file writes are executed at the resolved destination. Triggering the vulnerability requires only an authenticated administrative session and a crafted API invocation.

The vulnerability was resolved in commit f466c300191a609ed36c8d7c5d1e33ccd440786b by introducing strict validation inside the endpoint handler and sanitizing input parameters inside the database exporter module.

The comparison below highlights the changes introduced to validate the filename parameter inside the administrative API endpoint:

// In ghost/core/core/server/api/endpoints/db.js (Patched Code)
const filename = frame.options.filename;
if (filename && path.basename(filename) !== filename) {
    throw new errors.ValidationError({message: 'Export filename must not contain path separators'});
}

Additionally, the exporter utility was updated to prevent directory navigation sequences from reaching filesystem routines:

// In ghost/core/core/server/data/exporter/export-filename.js (Vulnerable Code)
if (options.filename) {
    return options.filename + '.json';
}
 
// In ghost/core/core/server/data/exporter/export-filename.js (Patched Code)
if (options.filename) {
    return path.basename(options.filename) + '.json';
}

This double-layered correction blocks malformed filenames at the API gateway layer and strips directory navigation sequences inside the core filesystem interaction layer.

Exploitation of CVE-2026-70592 requires administrative privileges within the target Ghost CMS instance. No complex configuration settings or specialized environments are necessary. The primary attack vector involves sending an authenticated POST request containing path navigation characters to the backup API endpoint.

An attacker constructs a request targeting /ghost/api/admin/db/backup/ with the query parameter filename containing relative path indicators, such as ../../../../config.production. The application processes this value and initiates a file creation routine targeting the resolved path with a .json extension appended.

POST /ghost/api/admin/db/backup/?filename=../../../../config.production HTTP/1.1
Host: ghost-target.local
Authorization: Bearer [JWT_TOKEN]
Content-Type: application/json
Connection: close

The resulting request triggers a write operation that places a JSON representation of the database at the target path, such as /var/www/ghost/config.production.json. This overwrite action allows attackers to disrupt services or alter configuration details on the local filesystem.

The impact of CVE-2026-70592 is classified as Medium, represented by a CVSS v3.1 score of 5.5. The scope metric is set to Changed because the application flaw enables write operations that escape the application context, modifying elements of the hosting system's filesystem directly.

Attackers can overwrite critical files such as config.production.json, modifying database connection strings, email configurations, or storage adapters. This level of manipulation can induce persistent Denial of Service or divert system communications to external destinations controlled by the attacker.

If the Ghost CMS daemon runs with elevated permissions on the host system, the impact may extend to other system-level folders. Overwriting Node.js dependency structures or configuration files in the wider environment can crash the main service thread or execute modified code when the process restarts. The overall severity depends heavily on filesystem write permissions assigned to the Ghost application process.

The recommended remediation for CVE-2026-70592 is to upgrade the Ghost CMS instance to version 6.54.1 or later. This release contains the necessary input checking logic to block path traversal sequences during the API request life cycle.

If an immediate upgrade is not feasible, administrators can disable JS-based backups entirely to mitigate exposure. This is done by modifying the application configuration to deactivate the database backup module.

{
  "disableJSBackups": true
}

Administrators can also apply this workaround by setting the environment variable disableJSBackups to true. Furthermore, running Ghost under a strict least-privilege system user account restricts write capabilities to specified directories, preventing system-wide configuration tampering.