CVE-2026-103290

Name of the Vulnerable Software and Affected Versions Ghost versions 6.14.0 through 6.26.x

Description The ImageSize service contains a path traversal issue where insufficient input validation of user-supplied file paths allows authenticated staff users to access local files located outside the intended data storage directories on the server. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder.

Recommendations Update Ghost to version 6.27.0 or later.