CVE-2026-70593: Path Traversal and Arbitrary File Write via Custom Theme Upload in Ghost CMS

Ghost CMS implements a customizable theme architecture where users with high privileges can package presentation layouts as ZIP archives and upload them to the backend server. The uploaded archives are parsed, validated, and subsequently written to a designated local directory on the server's filesystem.

In vulnerable versions of Ghost, the application framework relies on the LocalStorageBase class to coordinate file system output. This class failed to verify that canonical absolute paths of written files resolved strictly inside the target storage directory. This omission allowed file writes to escape boundaries when handling nested archive paths containing relative directory traversal characters.

The vulnerability is categorized under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). By utilizing path traversal vectors, authenticated actors with theme upload permissions can execute arbitrary write operations, which can compromise system configuration files and lead to remote code execution under specific server environments.

The root cause of CVE-2026-70593 stems from two major flaws in the file persistence and validation routines. The primary flaw resides within the local storage adapter class, LocalStorageBase, which is used during theme extraction. The adapter calculates destination file paths using getUniqueFileName(file, targetDir), but it does not perform structural boundary verification on the resolved target paths.

Because the system did not canonicalize and check target file paths against the base destination folder, any path traversal sequence such as ../ within the ZIP file's headers would resolve outside the sandbox of the active theme folder. The file extraction engine would then write files to directories beyond the content/themes/ or content/images/ path roots.

The secondary flaw lies within the validation of theme naming parameters in the theme manager service (storage.js). The server did not reject directory names composed entirely of dots and slashes, such as . or ../. This flaw allows an attacker to exploit directory resolution mechanisms directly through administrative theme-naming interfaces.

The patch implemented in version 6.54.1 resolves both logical flaws by introducing strict directory-containment verification in LocalStorageBase.ts and directory name regex filtering in storage.js.

The following code diff illustrates the primary containment fix implemented in LocalStorageBase.ts:

// ghost/core/core/server/adapters/storage/LocalStorageBase.ts
class LocalStorageBase extends StorageBase {
    async save(file, targetDir) {
        const filename = await this.getUniqueFileName(file, targetDir);
        targetFilename = filename;
 
        // PATCHED: Canonicalize targetDir and append trailing slash to prevent partial-name bypasses
        const expectedPrefix = path.join(path.resolve(targetDir), '/');
        
        // PATCHED: Resolve absolute filename path and assert structural containment
        if (!path.resolve(targetFilename).startsWith(expectedPrefix)) {
            throw new errors.BadRequestError({
                message: 'Cannot save to the given filename'
            });
        }
 
        await fs.mkdirs(targetDir);
        // Extraction writes continue
    }
}

The second part of the patch addresses theme naming by filtering inputs against a regular expression:

// ghost/core/core/server/services/themes/storage.js
const INVALID_THEME_REGEX = /^[./]*$/;
 
// Reject theme names consisting strictly of path navigation characters
if (INVALID_THEME_REGEX.test(themeName)) {
    throw new errors.ValidationError({
        message: 'Invalid theme name.'
    });
}

The use of path.resolve combined with a trailing slash is a robust path validation technique. It guarantees that any resolved target path begins exactly with the canonical structure of the expected output directory, effectively stopping Zip Slip traversal tricks.

Exploitation of CVE-2026-70593 requires the attacker to hold administrative permissions, which limits the attack surface to authenticated users. This is classified as a 'Zip Slip' file manipulation attack.

An attacker begins by archiving a malicious file (e.g., a replacement configuration file or a payload shell) into a custom ZIP directory structure. The filename in the ZIP header is manually altered to include relative traversal paths, such as ../../../../var/www/ghost/config.production.json.

The attacker then uploads the custom theme ZIP using the administrative interface's theme section. The platform's zip parser extracts each archive entry. Because previous versions of LocalStorageBase did not validate containment, the program writes the file to the relative traversed directory, overwriting arbitrary targets within the write-permissions scope of the application process.

The severity of CVE-2026-70593 is rated as Medium (CVSS 6.6) primarily because high-privilege credentials are required to execute the exploit. However, the integrity impact is high (I:H) due to the arbitrary file write capability.

By overwriting templates or configuration files like config.production.json, an attacker can disable services, redirect logs, or modify runtime environment variables. This can lead to a denial of service (A:L) or execution-flow hijacking.

If the application is executed as a root or highly-privileged user, the attacker can overwrite sensitive system files or plant scheduled scripts (e.g., cron jobs) on the host filesystem. This leads to arbitrary code execution in the context of the underlying system, resulting in a full system compromise.

The recommended remediation is upgrading the local Ghost installation to version 6.54.1 or higher. This release contains the necessary canonical directory checks to block path traversal sequences.

In environments where an immediate update is not possible, system administrators must limit administrative and staff roles to trusted personnel only. Auditing the active user accounts ensures that rogue roles do not maintain custom theme upload privileges.

Deploying the Ghost CMS server under a dedicated, low-privilege system account is a crucial defense-in-depth practice. Denying write access to critical OS folders such as /etc/ or application root files outside of content/ prevents successful path-traversal attacks from overwriting essential system resources.