Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended data storage directories on the server.
Get the CyboWatch SIEM platform, hosting, and 24×7 SOC analysts. Call or email us to get started.