CyberRota Analysis
AI-GeneratedVersions 6.14.0 through 6.26.0 of Ghost contain a path traversal vulnerability in the ImageSize service, allowing authenticated staff users to exploit insufficient input validation and access local files beyond designated storage areas. While the severity is rated low, organizations using affected versions should prioritize patching to mitigate potential unauthorized access to sensitive files. This is particularly relevant for environments where staff users have elevated permissions and can interact with the ImageSize service.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended data storage directories on the server.