Path Traversal Vulnerability in Ghost by TryGhost Affecting Various Versions

CVE-2026-104417

What is CVE-2026-104417?

In versions of Ghost prior to 6.64.0, a path traversal vulnerability exists that allows authenticated administrators to improperly load JSON files from outside the active theme directory. By manipulating locale settings, attackers can access sensitive configuration files stored on the server, potentially leading to exposure of critical information.

References